S4U2self

S4U2Self allows an authenticated service to ask the KDC for a service ticket to itself on behalf of another user; it is a TGS exchange, distinct from obtaining a TGT or using S4U2Proxy to request a ticket to another service. This record covers a local privilege-abuse variant in which an operator controlling the target computer's machine-account or service-account context obtains a ticket representing a user and uses it against a service on that same computer. The required account context/credential and target service must match the ticket's key; S4U2Self and ticket-cache import do not themselves create an elevated process or Windows access token.