NTLM Security Support Provider (NTLMSSP) service does not properly check the function number in an LPC request, which could allow local users to gain administrator level access.
https://exchange.xforce.ibmcloud.com/vulnerabilities/6076
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-008
http://www.securityfocus.com/bid/2348
http://razor.bindview.com/publish/advisories/adv_NTLMSSP.html