Microsoft keeps evolving its security mechanisms while releasing new versions of Windows. These new introduced security features harden the system by invalidating bunch of exploit techniques, while bringing in new opportunities and stimulating new privilege bypass techniques research. This presentation focuses on the basics and principles of Windows privilege separation, describes the internal structure of token, how it supports DACL, privilege and mandatory level check, and how sandboxes mechanisms are built upon it. The basics of protected processes will also be discussed, as well as some practical sandboxes bypass techniques, especially the one related to junctions.