SeTokenIsRestricted
UINT8 __stdcall SeTokenIsRestricted(VOID *Token){
return(*((_DWORD *)Token + 50) & 0x10) != 0;
}Referenced by:
NtCompareTokens
NtImpersonateAnonymousToken
SeTokenCanImpersonate
SeTokenIsAdmin
SepAccessCheckAndAuditAlarmWithAdminlessChecks
SepIsImpersonationAllowedDueToCapability
SepNewTokenAsRestrictedAsProcessToken