What is access token and how it is used?

Access Tokens
An access token describes the security context of a process. When the process tries to perform various operations in the computer, Windows uses access token information to determine whether to allow or disallow each operation.
Each time a user or background process authenticates itself to some computer (e.g., when a user logs on), Windows NT/2000/XP/Server 2003 in that target computer builds an access token for that user for that session. An access token contains the following:
· SID for the user account
· SIDs for the groups the user is a member of (either directly or via other groups), including any well-known security principals, such as Interactive, the user dynamically "is a member of"
· List of the user rights held by the user or his groups
· Default permissions (default DACL) for newly created objects
· Owner SID—that is, the default owner for newly created objects (it must be one of the user or group SIDs in this access token)
· Primary group SID—that is, the default primary group for newly created objects (it must be one of the group SIDs in this access token)
· Access token source, which is an eight-character string that distinguishes sources such as Session Manager, LAN Manager, and RPC Server
· Indication of whether the access token is a normal ("primary") or impersonation access token
Especially the first three items identify "who" this process is and which rights it has. Each process has a primary access token. When a thread in a serving process impersonates a client, it has another access token called an impersonation token, or sometimes a client access token.
An access token is either built or copied. The access token is built during logon or authentication to a new server. If the user then starts new processes without specifying a different username, the access token of the starting process is copied more or less identically to the new process.
You may know that changes in group memberships are not effective until the user in question logs off and then logs on again. The reason is that the access token with the group information is generated only at logon time or when authenticating to a new server.