NtOpenThreadTokenEx - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
#ifndef _NTSEAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenThreadTokenEx(
    _In_ HANDLE ThreadHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ BOOLEAN OpenAsSelf,
    _In_ ULONG HandleAttributes,
    _Out_ PHANDLE TokenHandle
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwOpenThreadTokenEx(
    _In_ HANDLE ThreadHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ BOOLEAN OpenAsSelf,
    _In_ ULONG HandleAttributes,
    _Out_ PHANDLE TokenHandle
    );

#endif

View code on GitHub

Opens a handle to an impersonation token of a thread. This function is documented in Windows Driver Kit here and here.

Parameters

Access masks

Access mask Use
TOKEN_ASSIGN_PRIMARY Allows creating processes with this token and assigning the token as primary via NtSetInformationProcess with ProcessAccessToken.
TOKEN_DUPLICATE Allows duplicating the token via NtDuplicateToken.
TOKEN_IMPERSONATE Allows impersonating the token via NtSetInformationThread with ThreadImpersonationToken.
TOKEN_QUERY Allows querying most information classes via NtQueryInformationToken.
TOKEN_QUERY_SOURCE Allows querying TokenSource via NtQueryInformationToken.
TOKEN_ADJUST_PRIVILEGES Allows adjusting token privileges via NtAdjustPrivilegesToken
TOKEN_ADJUST_GROUPS Allows adjusting token privileges via NtAdjustGroupsToken
TOKEN_ADJUST_DEFAULT Allows setting most information classes via NtSetInformationToken.
TOKEN_ADJUST_SESSIONID Allows setting TokenSessionId via NtSetInformationToken.
TOKEN_ALL_ACCESS_P All of the above except for the TOKEN_ADJUST_SESSIONID right, plus standard rights.
TOKEN_ALL_ACCESS All of the above plus standard rights.

Notable return values

Remarks

To avoid retaining unused resources, call NtClose to close the returned handle when it is no longer required.

Instead of opening the current thread token for query, consider using the NtCurrentThreadToken pseudo-handle on Windows 8 and above.

If you don't want to specify custom handle attributes, you can use NtOpenThreadToken.

To set a thread token, use NtSetInformationThread with ThreadImpersonationToken. See THREADINFOCLASS for more details.

Related Win32 API

See also