2

In my application I'm using ntrights.exe, that is part of Windows Resource Kit, to grant and revoke a specific user right.

For example to grant a user "Log on as a server" right, I execute using shell object following command:

ntrights -u User +r SeServiceLogonRight

However ntrights doesn't allow you to check if a user has a specific right.

Can you tell me how I can check if a user has a specific right?

Improve this question

2 Answers 2

Reset to default
2

Your best bet would be to create a token as the user (using the LogonUser API) and then examine the token returned in phToken. This way you're getting OS code to create the security token, rather than trying to do some halfway approximation yourself. I'm assuming you're creating a service account context, so you should have the plaintext password for the account laying around to call LogonUser.

Some advice from a working sysadmin: If you're developing an application for public consuption don't use a tool like "ntrights" to modify the security policy on my machines. Tell me in the documentation what rights need to be granted to the user context your service will be running under and I'll grant the rights however I want (using group policy, etc). You can certainly offer the option to modify the local security policy, but document the need for the rights and let more advanced sysadmins handle it themselves. (It's frustrating to support an application that makes "behind the scenes" changes to local security policy w/o clear documentation. In a domain environment I often want changes like that made in group policy rather than local security policy. I suspect others would agree with me.)

Improve this answer
0

You can do this using an open-source tool I wrote:

https://github.com/Bill-Stewart/PrivMan

Example:

PrivMan -a accountname -t SeServiceLogonRight

Returns an exit code of 1 if the account has the listed privilege/right, or 0 if not. You can also specify a space-delimited list of privileges/rights after the -t option if you enclose them in "; e.g.

PrivMan -a accountname -t "SeServiceLogonRight SeNetworkLogonRight"

Returns an exit code of 1 if the account has all of the listed privileges/rights, or 0 if not.

Improve this answer

You must log in to answer this question.