Create a token object

This security setting determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token.

This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System.


Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system.

Policy path: 

Computer Configuration\Windows Settings\Local Policies\User Rights Assignment


Logoff required



Supported on: 

At least Windows XP SP2, Windows Server 2003

Registry settings: 

User Rights security settings are not registry keys

Reboot required: 


Related content