# Dump LSASS when Debug Privilege is disabled
## SeDebugPrivilege
SeDebugPrivilege is managed by a Local GPO Policy on **Group Policy Management Editor → Windows Settings → Security Settings → Local Policies → User Rights Assignment → Debug programs → Define these policy settings**. There you can configure the users/groups that can debug programs. By default Local Administrators are configured.
This Privilege is needed when a program crashes and a memory dump needs to be created for the support to troubleshoot.
I found this () article that said if we minimize the privileges on LSASS, we can prevent credential dumping. Let's see.
## Dump LSASS as Local Administrator with Domain Admins assigned privileges
A domain administrator can create a GPO that only allows Domain Admins to debug programs.
This way, even with a Local Administrator Account and High Integrity, creating dumps will fail.
Opening the LSASS Process Permissions, we can see that SYSTEM and Local Administrators only have Read and Execute Permissions, which are not enough to dump the memory:
But, TrustedInstaller has Full Control over the process:
### TrustedInstaller
The TrustedInstaller () is a Windows Modules Installer component, responsible for helping you install, modify and remove updates and other Windows components. It’s essentially a built-in, hidden “user account” in Windows 10, as well as Windows 8 and Windows 7.
To interact with TrustedInstaller as a Local Administrator, we can either use its session token (using something like Incognito), or run a process on TrustedInstaller Service.
Running whoami as TrustedInstaller with the output added to a file will result in the creation of the file but no output. Meaning we executed a command with TrustedInstaller permissions:
### LSASS Dump
To dump LSASS, we can use something like Procmon (but you can use anything you want):
As we can see, it did manage to dump the LSASS memory using procdump as TrustedInstaller. (Something to notice, procdump is flaged as malicious by Windows Defender, so prior to dumping the memory, either try to make it undetectable or use another method)
Finally, we dump the credentials with mimikatz:
## Dump LSASS as Local Administrator with no user assigned to debug programs
Another thing an Administrator can do, is remove all the users from debugging the programs. Using this, they prevent admins from creating memory dumps, but also prevent hackers from dumping LSASS.
Or do they?
We remove every user/group from the GPO which allows Program Debugging and retry everything:
Again, TrustedInstaller has full access to the process:
We try again to do the same thing:
As we can see, we can dump LSASS and credentials dump again:
So, not assigning anyone did not make any change.
## Removing Full Control from TrustedInstaller
We remove all privileges from TrustedInstaller on LSASS.
We can still dump LSASS:
Needless to say, the credentials too:
## Closing Remarks
In the end, we managed to dump LSASS even with minimized permissions on it. Of course, all of these examples need Local Admin Rights, but you get the idea.
As for detection, I would say EDR catches TrustedInstaller modifications, so monitoring them is a good start. Another thing you can do is monitor TrustedInstaller's binary and commands. Adversaries can change the name ofc, but again, that's a good start.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://blog.pepperclipp.com/pepperclipp-public/other-articles/dump-lsass-when-debug-privilege-is-disabled.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.