Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For Windows 2008 R2 and Windows 7.

Is there a way to use powershell or other language to script Local Security Settings? For example, add a local user to the "Create global objects" policy?

Also for modifying DCOM settings?

This is to be part of an install script for a legacy app that is being ported to Windows 7.

Thanks, Mike

share|improve this question

The "official" method for automating the deployment of security settings is a combination of Security Templates and the Secedit tool to apply the templates.

Programmatically setting DCOM permissions is a huge blind spot that Microsoft still hasn't addressed to my satisfaction. The "State of the Art" in setting DCOM permissions on remote computers, last I checked, is still to do registry merges. (This unsupport DCOM permissions tool might be helpful to you, too, but I've never used it and can't speak to its effectiveness.)

share|improve this answer
as you mentioned security templates won't help with dcom perms. It seems simpler to use 1 script to make the changes per app rather than creating templates and still require a script for reg merges. – Jim B Jul 7 '10 at 15:00
It's all up to you. I'd use "Security Templates" because I think that would be easier for "the next person" to understand (assuming they're familiar with that functionality in the operating system, of course). DCOM permissions are an ugly, nasty swamp that Microsoft needs to "drain" in an officialy supported way. – Evan Anderson Jul 7 '10 at 18:20

The only way I've ever found is to review the registry entries created by this type of action and using either reg.exe (or the scripting language of your choice) to re-create the entries and reboot. Of course once you export the registry entries you could also convert them to ADM/ADMX files to use group policy to push them out.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.