Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On Windows Server 2008 R2 Core Edition, how do I assign the "log on as a service" permission to a user, from the command-line?

(ntrights.exe from the Win2003 resource kit is not included in Win2008 R2 Core).

I don't mind whether it's cmd or a powershell cmdlet. I would prefer it to be a command run locally on the box, rather than one invoked remotely.

The server is not, and will not be, part of an active directory.

share|improve this question

2 Answers 2

If you have another computer that can connect a Group Policy Object MMC to the Core Server that is the easiest way to edit the Logon As A Service privildge.

If not, you can on the server create a file with:

[Unicode]
Unicode=yes
[Privilege Rights]
SeServiceLogonRight = *S-1-5-80-0

The List of SIDs is comma separated. They have to be the actual SIDs not the account names. You have to include all the SIDs, this doesn't add or remove, it replaces the current list.

Make a backup of your current configruation:

secedit /export /cfg c:\backup.txt

Once you've got the file you can run:

secedit /configure /db secedit.sdb /cfg filename.txt
share|improve this answer
up vote 4 down vote accepted

I ended up grabbing ntrights.exe from the Windows 2003 Resource Kit and placing it on the server, then running ntrights +r SeServiceLogonRight -u <my user>.

I didn't install the resource-kit, because

  • I only needed ntrights.exe
  • Installation threw some OLE-related errors (that seemed to be irrelevant, but still)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.