16

Given a pair of a user and a privilege I need to determine if a user has the privilege on the server. The following is true in my setup:

  • The server is a part of a domain but not a domain controller
  • There are several domains with trust relationship in the infrastructure
  • Sometimes users (local, domain, or from a different domain) can belong to a local group by a merit of them being in some other group (domain or local) that belongs to a local group, as opposed to belonging to the group directly.

Example scenario for the last point:

  • User1 belongs to group TeamA in the DomainA
  • DomaimA\TeamA is a member of DomainB\SpecialAccess
  • DomainB\SpecialAccess is a member of DomainB\DomainAdmins
  • Finally DomainB\DomainAdmins belong to local Administators group
  • Local Administators group has SeRemoteInteractiveLogonRight privelege

Now If I have on the input DomainA\User1 and SeRemoteInteractiveLogonRight I need to arrive to Yes or No answer. So I open the Local Policy on the machine, note what groups are listed against the right I'm interested too then go to the server managers and see what at the group members and then I need to see what members of any groups in these groups and so on.

I have a gut feeling that it can be easier. I was really excited when I found AccessChk utility It lasted whole three minutes that took me to discover that it only lists direct relationship, so user within a group won't be listed.

Now I'm guessing that it would be possible to combine results from AccessChk some how so that I can check if a user belongs to any of the groups that AccessChk return, but given that it's not a single domain but several of them I'm not sure how to approach this. Also AccessChk output does not seem to distinguish between a group and a user.

EDIT: In the spirit of not falling into XY problem trap, what I really need to do is to make sure that on a group of servers no specific user accounts that are used as IIS application pool identities have SeInteractiveLogonRight or SeRemoteInteractiveLogonRight privileges. I have no problem with the IIS part, but the last step of checking an account against a privilege is something that I'm struggling finding a straightforward way to check. I also would like to automate the check because this is something that will need to be done regularly.

12
  • 6
    This sounds like a job for... Resultant Set of Policy (RSoP)! technet.microsoft.com/en-us/library/cc758010%28v=WS.10%29.aspx
    – Davidw
    Jul 7, 2014 at 4:50
  • 1
    @zespri - My answer was garbage and I deleted it. The SeInteractiveLogonRight and SeRemoteInteractiveLogonRight user rights are handled differently than "normal" privileges and it looks like reporting on them is going to be problematic. If I come up with a solution for you I'll post another answer but, for now I've got nothing. Jul 9, 2014 at 3:20
  • 1
    @Davidw - RSoP is problematic in that the Local Security Policy defaults won't be reflected in the output. So, any "Not Configured" entries will just show up as "Not Configured" and you won't actually see what principals are granted the right by Local Security Policy. Finally, even if you do get a list of principals from Group Policy you'll be stuck expanding group memberships (potentially cross-domain, too) to replicate OS functionality. This has actually turned out the a much more challenging question than I expected it to be. Jul 9, 2014 at 3:27
  • 1
    @EvanAnderson Exactly! When I was asked to estimate how long it was going to take me, it seemed to be a straightforward task. And after a couple of days of googling and trying different things... nothing. Currently my plan is to pinvoke GetTokenInformation with TokenPrivileges token information class Of course I need to figure out first how to get hold of the token itself. This route seems the most promising at the moment. Jul 9, 2014 at 5:37
  • @zespri - NtOpenProcessToken() is probably the best way to get at the token. (Have a look at leeholmes.com/blog/2006/07/21/…) Jul 9, 2014 at 12:58

1 Answer 1

1

Access tokens do not have information about rights, only about privileges.

What you need to do is this:

  • Find the IIS worker process that corresponds to your app pool. Since you know the app pool identity that should be easy by enumerating all the processes with the worker process name, and filtering the one that has the identity. If there are more than one, you can use any.
  • Use GetTokenInformation with TokenGroup information class, not the TokenPrivilege on the process token. The result will give you all the transitive groups the identity belongs too. This means even indirect ones.
  • Now you can loop through these groups and call LsaEnumerateAccountRights on each one and collate the information. This will give you what you want.

The above relies on the existence of the process (and token) corresponding to the account identity. In your scenario this should not be a problem. In scenarios when this is a problem, you can try and use Active Directory lookup for Token-Groups computed attribute. This article lists a few approaches how to pull this off.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .