Show PRIVILEGES in Windows 2003 server

Question

How can I list the PRIVILEGES for a user in Windows 2003 Server (SP2) ?
I know I can do something like this:
C:\ whoami /priv

This only lists my current user. I need to specify a user and retrieve a list of privileges.

Answer 1

Depending on if you have the password information for the other user, you can simply do this:

runas /user:otherUser cmd.exe

For example, I just did that for a SQL Server 2008 account on the same computer and I could examine its privileges and etc.

Answer 2

If it's a local user you can use the command

net user username

If it's on a domain use the command

net user username /domain

Answer 3

If there is a process for that user running, you can open the process properties in Process Explorer and the security tab will list the privileges in that process token.

Answer 4

2 possibilities for you.

The first is kind of ugly, but there is another command called showpriv.exe that does the reverse of whoami /priv - you give it a privilege name and it shows what users/groups have that privilege. You could script it to loop through all the privileges and show users/groups with that privilege - and further script it to list the users in groups instead of groups.

The second is based on Powershell - get the Powershell Community Extensions and use the Get-Privilege cmdlet. You get your own privileges by running:

Get-Privilege

You can get it for another user by running:

$identity = New-Object System.Security.Principal.WindowsIdentity("domain\username")
Get-Privilege $identity