Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to know how I can tell if a right is being removed by a Group Policy. The right in question is SC_MANAGER_ENUMERATE_SERVICE and is preventing code from opening the Service Control Manager on a remote machine. The application with administrator level privileges on the local computer under a domain level account that has admin privileges on the target server. Both machines are running Window Server 2008 R2 and both firewalls are disabled.

share|improve this question
up vote 1 down vote accepted

If you have administrative rights on the remote machine, you can use gpresult.exe to generate a full report of all policies applied to the system and/or to a given user.

gpresult.ext /S <SERVER> /USER <DOMAIN>\<USER> /H <FILENAME>.html

Will create an HTML report detailing all policies applied to the remote system and to the specified user account whenever it logs on to that system. You can also of course run the command on the system itself, after logging on with your preferred user account; if doing this, then the /S and /USER parameters can be omitted.

share|improve this answer
This only lists the policies, not the rights within the policies. Is there a way to list the rights within the group policies, that are being allowed or denied? – James May 5 '11 at 0:34
For each policy are listed all the applied settings; if you don't find anything about rights there, then no policy is setting them. – Massimo May 5 '11 at 14:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.