Scripting Changes to Local Security Policy 1

[peterlyttle]

Hello, has anyone been able to script changes to the local security policy eg "User Account Control: Admin Approval Mode for the Builtin Administrator Account" = Enabled

I've tried looking at powershell and not found anything. I cant use a GPO as the server is only part of a workgroup. Any suggestions much appreciated!

 

[PScottC]

You'll have to do this in 2 parts. The first part is to create a security template using the "Security Templates" MMC snap-in. The second is to create a script (batch) that will apply the template to your target machine(s). (I'm writing this off the top of my head from memory, so you'll have to get the exact syntax)

The script will use the "secedit" command to do 2 or 3 steps: 1) create a configuration DB, 2) Analyze the the DB vs. your template, and 3) Apply your template to the machine.

I don't recall if you're required to do the analysis step or not, you may be able to skip from step 1 to step 3 with no issue.

PSC
[—] CCNP [•] CCSP [•] MCITP: Enterprise Admin [•] MCSE [—]

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[peterlyttle]

I had been getting an access denied message but seemingly that was due to a previous modification I had made to the local policy. A reboot fixed this and allowed me to apply the new .inf file!

Cheers