# TokenUniverse puts Windows access tokens behind a Delphi user interface > TokenUniverse is a MIT licensed Delphi program for experimenting with Windows access tokens, impersonation, process creation and Local Security Authority policy. It gives a researcher a GUI over native APIs such as CreateProcessAsUser and NtCreateUserProcess, ships as a precompiled Windows binary, and its own feature checklist shows exactly which parts are still unfinished. **diversenok/TokenUniverse** — An advanced tool for working with access tokens and Windows security policy. - Repository: https://github.com/diversenok/TokenUniverse - Stars: 670 · Forks: 71 - Language: Pascal - License: MIT - Published: 2026-10-21 · Updated: 2026-10-21 · Language: en - Canonical page: https://hysenlabs.com/projects/diversenok-tokenuniverse ## A research workbench for Windows security mechanisms TokenUniverse is a Windows desktop program for experimenting with access tokens and security policy. The project describes it as a tool for experimenting and researching Windows security mechanisms, and the scope is wide: creating, viewing, impersonating and modifying access tokens, spawning processes, managing the Local Security Authority, checking access, and editing the security of many kinds of objects. The audience follows directly from that scope. Windows internals developers, malware analysts and people debugging access denials are the obvious users. A developer who has just hit an access denied from a service, or a Windows logon where the token is not what the code expected, gets a window instead of a debugger session and a handle hitter. It is not an administration console, and it is not a general purpose security tool for ordinary machines. The implementation is Delphi, compiled with Embarcadero Delphi 10.4, and the version table in the project documentation lists version 0.5 dated August 7th, 2023. The licence is MIT, which lets you read, modify and reuse the source as long as the copyright notice is kept. ## Six ways to obtain a token, from plain impersonation to restricted variants The obtaining-tokens checklist is the longest part of the feature list and shows the range of logon techniques the program covers. Opening process and thread tokens is implemented, as is opening a token through direct impersonation and querying the terminal session token. Logging users in with credentials and logging them in without credentials through S4U logon are both present, and so is logging into virtual accounts. The more unusual entries matter just as much. Adding arbitrary group membership while logging a user in means the resulting token can be built with groups the account would not normally carry. Duplicating tokens and duplicating handles are implemented, as is searching for opened handles and opening linked tokens. Restricted tokens appear twice: creating them directly, and creating them through the Safer API. A token creation path the checklist labels NtCreareToken is marked as done, alongside creation of an anonymous token and an anonymous token that carries Everyone membership. Impersonating a logon session token through pipes and opening the clipboard token are also implemented. Two items in this group remain open: opening all accessible process and thread tokens in one pass, and creating LowBox AppContainer tokens. ## Editing token fields rather than only reading them A token viewer that only reads is a debugging aid. TokenUniverse goes further, and the viewing-and-editing checklist shows which fields can be changed. Groups can be enabled and disabled. Privileges can be enabled, disabled or removed outright, and integrity level can be lowered or raised. The token's UIAccess and mandatory policy state, its virtualization settings, its owner and primary group, its originating logon session, its default DACL and its full security descriptor can all be viewed and edited. Audit overrides are in the same group. A separate read-only section covers what the program reports without changing: user and restricting SIDs, statistics, source and flags, extended flags of the TOKEN_* family, the AppContainer SID, elevation type and logon session information, object and handle information, the object creator PID, and the list of processes holding handles to the token. Several fields are visible only in part. Verbose terminal session information, package identity information, trust level, capabilities, claims, AppModel policy, creation and last modification times, security attributes, handle flags for inheritance and protection, and privilege information are all still unchecked in the project checklist. The gap is real and it matters for anyone doing deep token forensics, since the fields you cannot see are often the ones that explain a denial. ## Impersonation, and spawning a process under someone else's identity The operations group covers what you do with a token once you hold it. Impersonation and safe impersonation are implemented, assigning primary tokens is implemented, and so is sending handles to another process and spawning processes with a token. Three operations in that group are still open: direct impersonation, sharing a token with another TokenUniverse instance, and linking logon sessions to create UAC-friendly tokens. Comparing two tokens is also on the open list, which is a notable omission for a tool whose entire subject is tokens. Process creation is the widest set of methods in the project. CreateProcessAsUser, CreateProcessWithToken and CreateProcessWithLogon with credentials are supported, alongside RtlCreateUserProcess, RtlCreateUserProcessEx, NtCreateUserProcess and NtCreateProcessEx. There are also routes that do not use a token at all: creation through code injection, ShellExecuteEx, ShellExecute via IShellDispatch2, WdcRunTaskAsInteractiveUser and WMI. The parameters you can control are just as granular. Current directory, desktop, window show mode, flags such as inherited handles and creating suspended, forced job breakaway, parent process override, child process policy, process protection including PPL, custom SxS registration, run as invoker or ignore elevation, an AppContainer SID, and a verification step that checks access to the desktop or window station. Environmental variables, mitigation policies, capabilities, a security descriptor and job assignment are not implemented. ## Local Security Authority and Security Account Manager views The program reaches beyond tokens into policy storage. Under Local Security Authority, global audit settings and per-user audit settings can be viewed and edited, privilege assignment and logon rights assignment are supported, and viewing or editing security is implemented. Creating virtual accounts, rendering the SID tree, enumerating accounts that hold a given right or privilege, showing the source of rights in a token, and quotas are all still open. The Security Account Manager side is thinner. Enumerating domain groups, aliases and users works, and viewing or editing their security works. Everything else on that list, domain information, group information, alias information, user information, enumerating group members, enumerating alias members, managing members of either kind, creating groups, aliases or users, and the SAM object tree, is unchecked. The tool also exposes an access check window for asking the system what a given token can do to a given object, and a security editor for changing the security of objects. Those two windows are where the Local Security Authority and token work becomes practical: you can look at a descriptor, decide who should hold it, and change it without leaving the program. ## What the checklist admits is missing The most useful thing about this project is that its feature list is a working document with boxes left empty. Reading it honestly tells you what not to rely on. The Security Account Manager is the clearest case. You can enumerate domain groups, aliases and users, but you cannot create a group, create a user, create an alias, enumerate members or manage them. Any workflow that depends on provisioning an account has to happen elsewhere. AppContainer work is half done too: viewing AppContainer information and listing child AppContainers work, while listing profiles per user, creating or deleting AppContainers, viewing package information and listing packages do not. The unchecked IDesktopAppXActivator entry in the process creation list points at the same gap, since packaged application activation is not covered. Deleting a process list entry and the verbose session, claims and capabilities fields complete the picture. Anyone building a pipeline around this tool will spend more time on the open boxes than the documentation suggests, which is an argument for treating the checklist as the specification rather than the screenshot gallery. ## Precompiled binaries, separate debug symbols, and a Delphi source layout Distribution is straightforward. The program supports Windows 7 and above, and precompiled binaries are published on the project's releases page, so a researcher does not need Embarcadero Delphi to try it. The source repository is laid out in the usual Delphi shape: a TokenUniverse.dpr entry point, a TokenUniverse.dproj project file, and separate Core, UI and NtUtilsUI directories for the non-visual code, the forms and the Windows API helper library. A .gitmodules file and a TokenUniverse.todo file are also present. Debugging your own build has a documented path. Symbol files named TokenUniverse.dbg can be downloaded from the releases page and placed in the same folder as TokenUniverse.exe, after which the program shows stack traces on unhandled exceptions. That is a small detail that saves a lot of time when a native call faults inside a token operation. The project documentation points to a compiling section further down for build instructions, and that section is not included in the project documentation shown here, so treat the documented compile recipe as unverified. The MIT licence on LICENSE.txt leaves you free to build and modify it yourself, and the repository is not archived, with the last push on 2026-10-07. The tagged releases, however, stop earlier: v0.5 on 2023-08-07, v0.3 on 2023-03-25 and v0.2 on 2022-07-24, which means the binaries on the releases page are older than the source tree. ## Conclusion TokenUniverse suits Windows internals developers, malware analysts and anyone who has to reason about why a token denies an action, and it is the wrong choice for general administration or for anyone who needs a feature-complete security account manager, since creating SAM groups and users is still unchecked in the project checklist. Before adopting it, download the matching TokenUniverse.dbg symbols so unhandled exceptions produce readable stack traces, and check the gap between the 2023-08-07 v0.5 binary and the 2026-10-07 last push to see which fixes exist only in source. ## FAQ ### What is TokenUniverse used for? It is a Windows desktop program for experimenting with access tokens and Windows security mechanisms, covering token viewing and editing, impersonation, process spawning, Local Security Authority policy and access checks. ### Which Windows versions does TokenUniverse support? The project states that the tool supports Windows 7 and above, and precompiled binaries are published on the releases page for that range. ### How do I get stack traces from TokenUniverse.exe? Download the debug symbols named TokenUniverse.dbg from the releases page and place them in the same folder as TokenUniverse.exe. The program will then show stack traces on unhandled exceptions. ### Can TokenUniverse create Windows users and groups? Not yet. In the Security Account Manager section of the feature checklist only enumeration of domain groups, aliases and users and viewing or editing their security are marked as done, while creating groups, aliases and users and managing members remain unchecked. ### What language is TokenUniverse written in and what is its licence? It is written in Delphi and compiled with Embarcadero Delphi 10.4, and it is released under the MIT licence. ## Sources - [diversenok/TokenUniverse on GitHub](https://github.com/diversenok/TokenUniverse) - [Issues](https://github.com/diversenok/TokenUniverse/issues) - [License: MIT](https://github.com/diversenok/TokenUniverse/blob/master/LICENSE) - [README](https://github.com/diversenok/TokenUniverse/blob/master/README.md) - [Releases](https://github.com/diversenok/TokenUniverse/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/diversenok-tokenuniverse