Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my application I'm using ntrights.exe, that is part of Windows Resource Kit, to grant and revoke a specific user right.

For example to grant a user "Log on as a server" right, I execute using shell object following command:

ntrights -u User +r SeServiceLogonRight

However ntrights doesn't allow you to check if a user has a specific right.

Can you tell me how I can check if a user has a specific right?

share|improve this question

Your best bet would be to create a token as the user (using the LogonUser API) and then examine the token returned in phToken. This way you're getting OS code to create the security token, rather than trying to do some halfway approximation yourself. I'm assuming you're creating a service account context, so you should have the plaintext password for the account laying around to call LogonUser.

Some advice from a working sysadmin: If you're developing an application for public consuption don't use a tool like "ntrights" to modify the security policy on my machines. Tell me in the documentation what rights need to be granted to the user context your service will be running under and I'll grant the rights however I want (using group policy, etc). You can certainly offer the option to modify the local security policy, but document the need for the rights and let more advanced sysadmins handle it themselves. (It's frustrating to support an application that makes "behind the scenes" changes to local security policy w/o clear documentation. In a domain environment I often want changes like that made in group policy rather than local security policy. I suspect others would agree with me.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.