SeTakeOwnershipPrivilege

SeTakeOwnershipPrivilege is a Windows user-right that lets its holder take ownership of any securable object — files, directories, registry keys, services — without already having access to it. Ownership, in turn, confers the implicit right to change the object’s DACL (WRITE_DAC), so this one privilege is effectively “grant yourself full control of anything.” It is assigned to the Administrators group by default, which is a large part of why admin-equivalent accounts are so dangerous. Abusing it maps to MITRE ATT&CK T1222.001 — File and Directory Permissions Modification: Windows File and Directory Permissions Modification, and it’s a standing privilege-escalation primitive.

Why ownership = control

Windows grants the owner of an object the ability to read and modify its security descriptor regardless of what the DACL says. So the two-step is always the same: take ownership, then rewrite the DACL to give yourself access.

# 1. Take ownership of the target file
takeown /f C:\path\to\target.exe
 
# 2. Grant your own account full control
icacls C:\path\to\target.exe /grant "$env:USERNAME:F"

takeown is the command-line front-end to the privilege; icacls performs the DACL rewrite. For registry keys the equivalent is Set-Acl on the key after taking ownership via the security descriptor APIs.

Escalation uses

• Replace a protected binary. The canonical target is an accessibility binary like C:\Windows\System32\Utilman.exe — take ownership, grant yourself write, swap in cmd.exe, and trigger it from the logon screen for a SYSTEM shell (see accessibility-feature-hijacking).
• Read otherwise-locked files. SAM hives, other users’ profile data, backup files — ownership bypasses the deny that would otherwise block you.
• Service / scheduled-task takeover. Take ownership of a service binary or its registry key, then repoint it (see windows-services, exploit-service-all-access).

Enumeration

An account holding the privilege shows it in whoami /priv:

SeTakeOwnershipPrivilege    Take ownership of files or other objects    Disabled

The privilege is held disabled by default and must be enabled in the token before use; takeown.exe handles that automatically, which is why the binary works without an explicit AdjustTokenPrivileges call.

Defenses

• Treat SeTakeOwnershipPrivilege (and the Administrators default that carries it) as a tier-0 asset; audit who holds it via security policy / GPO.
• Alert on takeown execution and on ownership-change events (Security EID 4670 — permissions change) touching System32 binaries, service images, and the SAM.
• Sensitive-object auditing on accessibility binaries catches the classic Utilman/sethc swap.

Related

• accessibility-feature-hijacking — the SYSTEM-shell payoff this privilege enables
• icacls — the DACL-grant step that follows the ownership grab
• windows-ntfs-permissions — the permission model ownership sits above
• windows-services — service binary / registry-key takeover targets

Sources

• File and Directory Permissions Modification: Windows Permissions
• Take ownership of files or other objects