Given a pair of a user and a privilege I need to determine if a user has the privilege on the server. The following is true in my setup:
- The server is a part of a domain but not a domain controller
- There are several domains with trust relationship in the infrastructure
- Sometimes users (local, domain, or from a different domain) can belong to a local group by a merit of them being in some other group (domain or local) that belongs to a local group, as opposed to belonging to the group directly.
Example scenario for the last point:
- User1 belongs to group TeamA in the DomainA
- DomaimA\TeamA is a member of DomainB\SpecialAccess
- DomainB\SpecialAccess is a member of DomainB\DomainAdmins
- Finally DomainB\DomainAdmins belong to local Administators group
- Local Administators group has SeRemoteInteractiveLogonRight privelege
Now If I have on the input DomainA\User1 and SeRemoteInteractiveLogonRight I need to arrive to Yes or No answer. So I open the Local Policy on the machine, note what groups are listed against the right I'm interested too then go to the server managers and see what at the group members and then I need to see what members of any groups in these groups and so on.
I have a gut feeling that it can be easier. I was really excited when I found AccessChk utility It lasted whole three minutes that took me to discover that it only lists direct relationship, so user within a group won't be listed.
Now I'm guessing that it would be possible to combine results from AccessChk some how so that I can check if a user belongs to any of the groups that AccessChk return, but given that it's not a single domain but several of them I'm not sure how to approach this. Also AccessChk output does not seem to distinguish between a group and a user.
EDIT: In the spirit of not falling into XY problem trap, what I really need to do is to make sure that on a group of servers no specific user accounts that are used as IIS application pool identities have SeInteractiveLogonRight or SeRemoteInteractiveLogonRight privileges. I have no problem with the IIS part, but the last step of checking an account against a privilege is something that I'm struggling finding a straightforward way to check. I also would like to automate the check because this is something that will need to be done regularly.