Improper access control in the Windows SMB Client, specifically within the `mrxsmb.sys` driver, allows an authorized or unauthenticated remote attacker to elevate privileges to the `NT AUTHORITYSYSTEM` level. The issue stems from flaws in access restriction during authentication relay. Attackers can use authentication coercion techniques, such as forcing a request to a UNC path, to compel a Windows host to connect to a malicious system via SMB. By manipulating `CREDENTIAL TARGET INFORMATIONW` and forcing the use of Kerberos over NTLM, an attacker can capture a Kerberos ticket from a computer account (`DOMAINMACHINE$`) and relay it back to the same host. This process results in a session with full system control over the target machine via standard RPC/SMB services.