Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I list the PRIVILEGES for a user in Windows 2003 Server (SP2) ?
I know I can do something like this:
C:\ whoami /priv

This only lists my current user. I need to specify a user and retrieve a list of privileges.

share|improve this question
    
Is this a workgroup or a domain? Do you have the other user's password? –  Wesley May 12 '10 at 2:27
    
workgroup, local user - do not have the other user's password. –  DB14 May 12 '10 at 2:59
add comment

4 Answers 4

Depending on if you have the password information for the other user, you can simply do this:

runas /user:otherUser cmd.exe

For example, I just did that for a SQL Server 2008 account on the same computer and I could examine its privileges and etc.

share|improve this answer
add comment

If it's a local user you can use the command

net user username

If it's on a domain use the command

net user username /domain
share|improve this answer
    
I don't believe that will show the users privileges on the local machine. –  joeqwerty May 12 '10 at 3:10
    
That won't do what the poster is asking for. Privileges aren't group memberships (which is the only thing even remotely close to what the poster is looking for that the "NET USER" command will return). –  Evan Anderson May 12 '10 at 16:11
add comment

If there is a process for that user running, you can open the process properties in Process Explorer and the security tab will list the privileges in that process token.

share|improve this answer
add comment

2 possibilities for you.

The first is kind of ugly, but there is another command called showpriv.exe that does the reverse of whoami /priv - you give it a privilege name and it shows what users/groups have that privilege. You could script it to loop through all the privileges and show users/groups with that privilege - and further script it to list the users in groups instead of groups.

The second is based on Powershell - get the Powershell Community Extensions and use the Get-Privilege cmdlet. You get your own privileges by running:

Get-Privilege

You can get it for another user by running:

$identity = New-Object System.Security.Principal.WindowsIdentity("domain\username")
Get-Privilege $identity
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.