Remove From User Right Assignment Vbscript

Set Logon As A Service right to User by Powershell, C#, CMD and VBScript

Description:

In this article, I am going to explain about how to set or grant user Logon As A Service permission/privilege using Local Security Policy, VBScript, Powershell, C# and Command Line tool.

Summary:


Set Logon As A Service right to user using Local Security Policy

Follow the below steps to set Log on As Service right via Local Security Policy

1. Open the Run window by pressing 'Windows' + 'R'  keys.
2. Type the command secpol.msc in the text box and click OK.

3. Now the Local Security Policy window will be open, in that window navigate to the node User Rights Assignment (Security Settings -> Local Polices ->User Rights Assignment). In right side pane, search and select the policy Log on as a service.



4. Double-click on the policy Log on as a service, in the opened windows click the button Add User or Group, select the user which you want to set logon as a service right and click OK, and click Apply button to finish.



Set or Grant User Logon As A Service right via Powershell

 We can set the Logon As A Service right to user in Powershell by importing the third party DLL ( Carbon ).  Before you run the below script you need to the download latest Carbon files from here Download Carbon DLL.

Steps to follow to set Logon As A Service right via Powershell :

  1. Download latest Carbon files from here Download Carbon DLL.
  2. If you have downloaded the files, extract the zip file and you could see the Carbon DLL inside bin folder (In my case: C:\Users\Administrator\Downloads\Carbon\bin\Carbon.dll).
  3. Copy the below Powershell script commands and place it notepad or textfile.
  4. Now you can replace your Carbon DLL path in following script for the variable $CarbonDllPath
  5. You can also replace the user identity that you are going to set logon as service right in the variable $Identity
  6. Now run as Powershell window with Admin Privilege (Run as Administrator)
  7. Copy the edited Powershell script and Run it in Powershell to set logon as a service right.

$Identity = "DomainName\Administrator" $privilege = "SeServiceLogonRight" $CarbonDllPath = "C:\Users\Administrator\Downloads\Carbon\bin\Carbon.dll" [Reflection.Assembly]::LoadFile($CarbonDllPath) [Carbon.Lsa]::GrantPrivileges( $Identity , $privilege)
Powershell output :



Other web site links for Carbon DLL:
 https://bitbucket.org/splatteredbits/carbon/downloads
 http://pshdo.com/
 http://get-carbon.org/help/Grant-Privilege.html

Set or Grant User Logon As A Service right/permission to user using C#

You can use the function GrantUserLogOnAsAService to set Logon as a Service right to user using C# code. This function uses the class LsaWrapper.

static void GrantUserLogOnAsAService(string userName) { try { LsaWrapper lsaUtility = new LsaWrapper(); lsaUtility.SetRight(userName, "SeServiceLogonRight"); Console.WriteLine("Logon as a Service right is granted successfully to " + userName); } catch (Exception ex) { Console.WriteLine(ex.Message); } } LsaWrapper class file
public class LsaWrapper { // Import the LSA functions [DllImport("advapi32.dll", PreserveSig = true)] private static extern UInt32 LsaOpenPolicy( ref LSA_UNICODE_STRING SystemName, ref LSA_OBJECT_ATTRIBUTES ObjectAttributes, Int32 DesiredAccess, out IntPtr PolicyHandle ); [DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)] private static extern long LsaAddAccountRights( IntPtr PolicyHandle, IntPtr AccountSid, LSA_UNICODE_STRING[] UserRights, long CountOfRights); [DllImport("advapi32")] public static extern void FreeSid(IntPtr pSid); [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true, PreserveSig = true)] private static extern bool LookupAccountName( string lpSystemName, string lpAccountName, IntPtr psid, ref int cbsid, StringBuilder domainName, ref int cbdomainLength, ref int use); [DllImport("advapi32.dll")] private static extern bool IsValidSid(IntPtr pSid); [DllImport("advapi32.dll")] private static extern long LsaClose(IntPtr ObjectHandle); [DllImport("kernel32.dll")] private static extern int GetLastError(); [DllImport("advapi32.dll")] private static extern long LsaNtStatusToWinError(long status); // define the structures private enum LSA_AccessPolicy : long { POLICY_VIEW_LOCAL_INFORMATION = 0x00000001L, POLICY_VIEW_AUDIT_INFORMATION = 0x00000002L, POLICY_GET_PRIVATE_INFORMATION = 0x00000004L, POLICY_TRUST_ADMIN = 0x00000008L, POLICY_CREATE_ACCOUNT = 0x00000010L, POLICY_CREATE_SECRET = 0x00000020L, POLICY_CREATE_PRIVILEGE = 0x00000040L, POLICY_SET_DEFAULT_QUOTA_LIMITS = 0x00000080L, POLICY_SET_AUDIT_REQUIREMENTS = 0x00000100L, POLICY_AUDIT_LOG_ADMIN = 0x00000200L, POLICY_SERVER_ADMIN = 0x00000400L, POLICY_LOOKUP_NAMES = 0x00000800L, POLICY_NOTIFICATION = 0x00001000L } [StructLayout(LayoutKind.Sequential)] private struct LSA_OBJECT_ATTRIBUTES { public int Length; public IntPtr RootDirectory; public readonly LSA_UNICODE_STRING ObjectName; public UInt32 Attributes; public IntPtr SecurityDescriptor; public IntPtr SecurityQualityOfService; } [StructLayout(LayoutKind.Sequential)] private struct LSA_UNICODE_STRING { public UInt16 Length; public UInt16 MaximumLength; public IntPtr Buffer; } /// //Adds a privilege to an account /// Name of an account - "domain\account" or only "account" /// Name ofthe privilege /// The windows error code returned by LsaAddAccountRights public long SetRight(String accountName, String privilegeName) { long winErrorCode = 0; //contains the last error //pointer an size for the SID IntPtr sid = IntPtr.Zero; int sidSize = 0; //StringBuilder and size for the domain name var domainName = new StringBuilder(); int nameSize = 0; //account-type variable for lookup int accountType = 0; //get required buffer size LookupAccountName(String.Empty, accountName, sid, ref sidSize, domainName, ref nameSize, ref accountType); //allocate buffers domainName = new StringBuilder(nameSize); sid = Marshal.AllocHGlobal(sidSize); //lookup the SID for the account bool result = LookupAccountName(String.Empty, accountName, sid, ref sidSize, domainName, ref nameSize, ref accountType); //say what you're doing Console.WriteLine("LookupAccountName result = " + result); Console.WriteLine("IsValidSid: " + IsValidSid(sid)); Console.WriteLine("LookupAccountName domainName: " + domainName); if (!result) { winErrorCode = GetLastError(); Console.WriteLine("LookupAccountName failed: " + winErrorCode); } else { //initialize an empty unicode-string var systemName = new LSA_UNICODE_STRING(); //combine all policies var access = (int) ( LSA_AccessPolicy.POLICY_AUDIT_LOG_ADMIN | LSA_AccessPolicy.POLICY_CREATE_ACCOUNT | LSA_AccessPolicy.POLICY_CREATE_PRIVILEGE | LSA_AccessPolicy.POLICY_CREATE_SECRET | LSA_AccessPolicy.POLICY_GET_PRIVATE_INFORMATION | LSA_AccessPolicy.POLICY_LOOKUP_NAMES | LSA_AccessPolicy.POLICY_NOTIFICATION | LSA_AccessPolicy.POLICY_SERVER_ADMIN | LSA_AccessPolicy.POLICY_SET_AUDIT_REQUIREMENTS | LSA_AccessPolicy.POLICY_SET_DEFAULT_QUOTA_LIMITS | LSA_AccessPolicy.POLICY_TRUST_ADMIN | LSA_AccessPolicy.POLICY_VIEW_AUDIT_INFORMATION | LSA_AccessPolicy.POLICY_VIEW_LOCAL_INFORMATION ); //initialize a pointer for the policy handle IntPtr policyHandle = IntPtr.Zero; //these attributes are not used, but LsaOpenPolicy wants them to exists var ObjectAttributes = new LSA_OBJECT_ATTRIBUTES(); ObjectAttributes.Length = 0; ObjectAttributes.RootDirectory = IntPtr.Zero; ObjectAttributes.Attributes = 0; ObjectAttributes.SecurityDescriptor = IntPtr.Zero; ObjectAttributes.SecurityQualityOfService = IntPtr.Zero; //get a policy handle uint resultPolicy = LsaOpenPolicy(ref systemName, ref ObjectAttributes, access, out policyHandle); winErrorCode = LsaNtStatusToWinError(resultPolicy); if (winErrorCode != 0) { Console.WriteLine("OpenPolicy failed: " + winErrorCode); } else { //Now that we have the SID an the policy, //we can add rights to the account. //initialize an unicode-string for the privilege name var userRights = new LSA_UNICODE_STRING[1]; userRights[0] = new LSA_UNICODE_STRING(); userRights[0].Buffer = Marshal.StringToHGlobalUni(privilegeName); userRights[0].Length = (UInt16) (privilegeName.Length*UnicodeEncoding.CharSize); userRights[0].MaximumLength = (UInt16) ((privilegeName.Length + 1)*UnicodeEncoding.CharSize); //add the right to the account long res = LsaAddAccountRights(policyHandle, sid, userRights, 1); winErrorCode = LsaNtStatusToWinError(res); if (winErrorCode != 0) { Console.WriteLine("LsaAddAccountRights failed: " + winErrorCode); } LsaClose(policyHandle); } FreeSid(sid); } return winErrorCode; } }


Set Logon As A Service right to user via Command Line

You can use the NTRights.exe utility to grant or deny user rights to users and groups from a command line or a batch file. The NTRights.exe utility is included in the Windows NT Server 4.0 Resource Kit Supplement 3. Refer: http://support.microsoft.com/kb/266280

Set Logon As A Service right
ntrights +r SeServiceLogonRight -u "Domain\Administrator" Revoke Logon As A Service right
ntrights -r SeServiceLogonRight -u "Domain\Administrator"

Set or Grant Logon As Service right/privilege to user via VBScript

1. Copy the below example VBScript code and paste it in notepad or a VBScript editor.
2. Change the value for strUserName if you want to give your own name otherwise simply leave it.
3. Save the file with a .vbs extension, for example: SetLogonAsAServiceRight.vbs
4. Double-click the VBScript file (or Run this file from command window) to Set Logon As Service right/permission to user.

' SetLogonAsAServiceRight.vbs ' Sample VBScript to set or grant Logon As A Service Right. ' Author: http://www.morgantechspace.com/ ' ------------------------------------------------------' Dim strUserName,ConfigFileName,OrgStr,RepStr,inputFile,strInputFile,outputFile,obj strUserName = "work2008\DevUser" Dim oShell Set oShell = CreateObject ("WScript.Shell") oShell.Run "secedit /export /cfg config.inf", 0, true oShell.Run "secedit /import /cfg config.inf /db database.sdb", 0, true ConfigFileName = "config.inf" OrgStr = "SeServiceLogonRight =" RepStr = "SeServiceLogonRight = " & strUserName & "," Set inputFile = CreateObject("Scripting.FileSystemObject").OpenTextFile("config.inf", 1,1,-1) strInputFile = inputFile.ReadAll inputFile.Close Set inputFile = Nothing Set outputFile = CreateObject("Scripting.FileSystemObject").OpenTextFile("config.inf",2,1,-1) outputFile.Write (Replace(strInputFile,OrgStr,RepStr)) outputFile.Close Set outputFile = Nothing oShell.Run "secedit /configure /db database.sdb /cfg config.inf",0,true set oShell= Nothing Set obj = CreateObject("Scripting.FileSystemObject") obj.DeleteFile("config.inf") obj.DeleteFile("database.sdb") Msgbox "Logon As A Service Right granted to user '"& strUserName &"' using Vbscript code"
Thanks,
Morgan
Software Developer
---------------------

How to Add or Remove Users and Groups from "User Rights Assignment" in Windows


   Information

User Rights Assignment policies determines which users or groups have logon rights or privileges on the computer. This will show you how to add (assign) or remove users and groups for each User Rights Assignment policy in Vista, Windows 7, or Windows 8.

You must be logged in as an administrator to be able to do the steps in this tutorial.

   Note

If you remove a user or group, then that user or group will no longer be able to perform the policy on the computer.

If you add a user or group, then that user or group will now be able to perform the policy on the computer.

For more information about each specific user rights policy, see: User Rights

   Warning

This tutorial is not for a beginner to try.

I would highly recommend that you create a restore point before making changes to the User Rights Assignment. This way if you make a mistake and lock yourself, a user, or a group out of a policy that you didn't want to, you will be able to do a system restore at boot and select the restore point to undo the mistake.






OPTION ONE
Through Local Security Policy
1. Open the Local Security Policy window, expand Local Policies in the left pane, and select User Rights Assignment. (see screenshot below)

2. In the right pane of User Rights Assignment, double click on a listed Policy (ex: Shut down the system) that you wanted to add or remove a user or group, then go to step 3 and/or 4 below. (see screenshot above)

3. To Remove a User or Group from a User Rights Assignment Policy
A) Select (highlight) a listed user(s) and/or group(s) that you wanted to remove from the policy, then click on the Remove button. (see screenshot below)
NOTE:You can press and hold the CTRL key to select more than one listed user (user account name) and/or group.

B) Click on Apply. (see screenshot below)

C) Go to step 4 or 5 for what you would like to do.
4. To Add a User or Group to a User Rights Assignment Policy
A) Click on the Add User or Group button. (see screenshot above)

B) Click on the Advanced button. (see screenshot below)

C) Click on the Object Types button. (see screenshot below)

D) Check only the Users and Groups boxes, and click on OK. (see screenshot below)

E) Click on the Find Now button. (see screenshot below)

F) In the bottom pane under Search results, select the user(s) and/or group(s) that you wanted to add to the policy, then click on OK. (see screenshot below)
NOTE:You can press and hold the CTRL key to select more than one listed user (user account name) and/or group.

G) Click on OK. (see screenshot below)

H) Click on Apply. (see screenshot below)

5. When finished, click on OK. (see screenshots below steps 3B and 4H)

6. Close the Local Security Policy window. (see screenshot below step 1)



OPTION TWO
Using an Elevated Command Prompt
1. If you have not already, click on the Download button below to download the ntrights.zip file originally from within the Windows Server 2003 Resource Kit Tools.


A) Open the downloaded .zip file, and extract (drag and drop) the ntrights.exe file to your desktop.

B) Right click on the ntrights.exe file, click on Properties, General tab, and click on the Unblock button if available.
NOTE:If you do not have a Unblock button under the General tab, then the file is already unblocked and you can continue on to step 1C.

C) Right click on the ntrights.exe file and click on Move.

D) Open Windows Explorer and navigate to and open the C:\Windows\System32 folder, then Paste the ntrights.exe file to move it here.

E) If prompted, click on Continue and Yes to approve moving the ntrights.exe file into the System32 folder, then close the Windows Explorer window.
2. Open an elevated command prompt, and do step 3 and/or 4 below.

3. To Remove a User or Group from a User Rights Assignment Policy
A) In the elevated command prompt, type the command below for what user or group that you would like to remove from what policy, and press Enter.
NOTE:See blue note box below step 4.
ntrights -U "User or Group" -R PolicyConstantName
For example:If I wanted to remove the standard users group "Users" from being able to "Shut down the system", then I would type the command below.

ntrights -U "Users" -R SeShutdownPrivilege
B) Go to step 4 or 5 for what you would like to do.
4. To Add a User or Group to a User Rights Assignment Policy
A) In the elevated command prompt, type the command below for what user or group that you would like to add to what policy, and press Enter.
NOTE:See blue note box below step 4.
ntrights -U "User or Group" +R PolicyConstantName
For example:If I wanted to add the standard users group "Users" to be able to "Shut down the system", then I would type the command below.

ntrights -U "Users" +R SeShutdownPrivilege
   Note

Substitute User or Group in the command with actual name of the user account or group within quotes.

Substitute PolicyConstantName in the command for the actual Constant Name at the link below for the Group Policy Name that you wanted to add or remove a user or group.

User Rights




5. When finished, close the elevated command prompt.
That's it,
Shawn






Categories: 1

0 Replies to “Remove From User Right Assignment Vbscript”

Leave a comment

L'indirizzo email non verrĂ  pubblicato. I campi obbligatori sono contrassegnati *