Security
Español

whoami: identify current user and audit token privileges

Use whoami and whoami /priv from Cerewro to know which user and privileges are running. Essential for security audits.

Equipo Cerewro
whoami privilegios seguridad token

What is whoami and why does it matter for security?

whoami returns the domain and username of the current process. It seems simple, but in administration and pentesting it is essential to confirm the execution context before launching privileged commands.

CMD — Current user
whoami
Full qualified domain name
whoami /fqdn

Audit token privileges with whoami /priv

The /priv parameter shows all privileges of the security token: which are enabled, disabled or removed. Essential for detecting processes with excessive privileges.

View all token privileges
whoami /priv
View security groups
whoami /groups
Full info: user + groups + privileges
whoami /all

Key privileges to watch

PrivilegeRiskDescription
SeDebugPrivilegeHighAllows debugging any process, including LSASS
SeImpersonatePrivilegeHighCan be used for privilege escalation
SeBackupPrivilegeMediumAllows reading any file bypassing ACLs
SeShutdownPrivilegeLowCan shut down the system
Cerewro Tip: Ask "What user and privileges is Cerewro running with?" and the AI runs whoami /all, analyzes the privileges and warns you if any high-risk privilege is enabled.