GPO + service rights

[Hondy]

Hi

If I install some software such as backup exec and supply a credential to that app and it pops up and tells my "account has been given 'logon as a service' right".

Where is this explicitly given? I see you can add it into the GPO, but how do you see what services already have "log on as a service" role when the policy is set at default?

When default is set for this policy there is a number of accounts that aleady have this permission, but how do you know? When "default" is selected there isn't a list of accounts that have it...

Cheers

 

[Hondy]

Or... if anyone can tell me how to enumerate the priviledges of a particular account or how to enumerate what accounts are assigned to a particular priviledge.

Cheers!

 

[TechyMcSe2k]

go to the machines Local Security Policy under administrative tools, under Local Policies/User Rights Assigntment find the "Log on as a service" it will list them there. If this is for a DC then you will need to check the Domin Controllers GPO in the same place.

Cliff, MCSE/MCSA/MCTS/CCNA/VCP/CCA

http://www.samtechconsulting.com

 

[Hondy]

yeh, i see that, what I want to be able to do is say "what privileges does account BACKUP have" and have it list them. You must be able to do it from a WMI script or something if you run it under administrator.

 

[TechyMcSe2k]

Beyond me on that one, I do basic .bat and .vbs scripting, any WMI specialists out there?

Cliff, MCSE/MCSA/MCTS/CCNA/VCP/CCA

http://www.samtechconsulting.com