bingo you can do some really problematic things with it
-
So which user account is making this call in a legitimate scenario? Backup operator?
Normal flow is that first NTFS connects to lsass through an ALPC port. LSASS Then impersonates the caller and open the file to operate on. It opens with only FILE_READ_ATTRIBUTTE though it will then do IOCTLS that read and write anyway. ifsutilx.dll will handle the requests and
-
-
verify that the process of the calling thread have TCB . Unless of course encryption must be done and there is no private key assigned for the user.... Then lsass also generate that first
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
i also stubled upon this... Ive alvays knew it was a lie https://support.microsoft.com/en-us/windows/how-reserved-storage-works-in-windows-10-5bc98443-0711-8038-4621-6a18ddc904f2 …
-
to me it looks more like a place to stash the telemetric data- you cant submit data when bsod.....pic.twitter.com/PcHbK8LxgN
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.