When you log into your Windows desktop what information does your Security Access Token (SAT) contain?

Group SIDs are used by the security subsystem during token construction to resolve effective privileges, but the resulting SAT is defined by the computed privilege list rather than being characterized as a raw collection of group membership identifiers.

Cached credentials are stored in the registry under a hashed format to enable offline domain logon and are a separate mechanism entirely, not a component of the Security Access Token created during an interactive logon session.

When a user logs into Windows, the Local Security Authority (LSA) builds an access token that includes the list of privileges - such as SeShutdownPrivilege or SeAuditPrivilege - assigned to the user through direct grants or group memberships in the domain. The operating system references these domain privileges on every privileged operation to determine whether the user has the right to perform that action. This privilege list is the primary authorization artifact that defines what the authenticated session is permitted to do.

The SAT is scoped to the single authenticated user's logon session and contains no information about other locally authenticated users, as each logon session maintains its own independent token.