> For the complete documentation index, see [llms.txt](https://coffeetohack.gitbook.io/coffeetohack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://coffeetohack.gitbook.io/coffeetohack/active-directory/token-impersonation.md).

# Token Impersonation

Tokens are temporary keys that provide access to a system or network. With these, you do not have to provide credentials each time to access a file.

There are two types of tokens:

1. Delegate: This type of token is created for logging into a machine or using RDP. These tokens exists until the computer is rebooted.
2. Impersonate: These are non-interactive such as attaching a network drive or a domain logon script.

If we gain access to a machine and we have token of a domain admin that we can impersonate, we have domain admin access.

<div align="left"><figure><img src="https://1900160215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8BnwqwOpw0p82p0cMp%2Fuploads%2F6Qrg72V3V1BIZivU057J%2Fimage.png?alt=media&amp;token=9545cfa3-eeda-487e-bd72-8fe078526254" alt=""><figcaption></figcaption></figure></div>

This will only work if the token of administrator is present on the computer. This means that it will only work if there is an admin/user session (admin/user logged in) to that computer.