Adding security setting via cmd line

[dporrelli]

Hi All,

I am trying to create a batch file which will prompt a user to enter 3 user names (i.e. domain\user) and then add the user to the Administrators group and the following user rights assignments:
Act as part of the operating system
Bypass traverse checking
create a token object
Log on as a batch job
Log on as a service
managing auditing and security log
Replace a process level token

Any help would be brilliant

Thanks

Del

 

[dporrelli]

Got it working manually by copying the ntrights.exe from the 2003 kit and doing this:
net localgroup Administrators domain\servicesuser /ADD
net localgroup Administrators domain\sqluser /ADD
net localgroup Administrators domain\adminuser /ADD

ntrights.exe -u "domain\servicesuser" +r SeTcbPrivilege
ntrights.exe -u "domain\sqluser" +r SeTcbPrivilege
ntrights.exe -u "domain\adminuser" +r SeTcbPrivilege

ntrights.exe -u "domain\servicesuser" +r SeBatchLogonRight
ntrights.exe -u "domain\sqluser" +r SeBatchLogonRight
ntrights.exe -u "domain\adminuser" +r SeBatchLogonRight

ntrights.exe -u "domain\servicesuser" +r SeServiceLogonRight
ntrights.exe -u "domain\sqluser" +r SeServiceLogonRight
ntrights.exe -u "domain\adminuser" +r SeServiceLogonRight

ntrights.exe -u "domain\servicesuser" +r SeCreateTokenPrivilege
ntrights.exe -u "domain\sqluser" +r SeCreateTokenPrivilege
ntrights.exe -u "domain\adminuser" +r SeCreateTokenPrivilege

ntrights.exe -u "domain\servicesuser" +r SeChangeNotifyPrivilege
ntrights.exe -u "domain\sqluser" +r SeChangeNotifyPrivilege
ntrights.exe -u "domain\adminuser" +r SeChangeNotifyPrivilege

ntrights.exe -u "domain\servicesuser" +r SeCreateTokenPrivilege
ntrights.exe -u "domain\sqluser" +r SeCreateTokenPrivilege
ntrights.exe -u "domain\adminuser" +r SeCreateTokenPrivilege

ntrights.exe -u "domain\servicesuser" +r SeSecurityPrivilege
ntrights.exe -u "domain\sqluser" +r SeSecurityPrivilege
ntrights.exe -u "domain\adminuser" +r SeSecurityPrivilege

ntrights.exe -u "domain\servicesuser" +r SeAssignPrimaryTokenPrivilege
ntrights.exe -u "domain\sqluser" +r SeAssignPrimaryTokenPrivilege
ntrights.exe -u "domain\adminuser" +r SeAssignPrimaryTokenPrivilege