At logon, the LSASS creates both an Administrator and Limited User Account (LUA) version of the Administrator token and links both of them to the logon session. The userinit process (which is the first process created by winlogon) is created with the LUA token.
Would you like to comment?
Join Diigo for a free account, or sign in if you are already a member.