JSI Tip 9480. How can I display the User Rights Assignment on a specified computer?

You can use Group Policy to set the User Rights Assignment on computers, and you can use NTRights.exe to set user rights in a script.

Some of the user rights that can be granted or revoked in a script are:

Windows NT right Permits user to
SeAssignPrimaryTokenPrivilege Replace a process level token.
SeAuditPrivilege Generate security audits.
SeBackupPrivilege Back up files and directories.
SeBatchLogonRight Logon as a batch job.
SeChangeNotifyPrivilege Bypass traverse checking.
SeCreatePagefilePrivilege Create a pagefile.
SeCreatePermanentPrivilege Create permanent shared objects.
SeCreateTokenPrivilege Create a token object.
SeDebugPrivilege Debug programs.
SeIncreaseBasePriorityPrivilege Increase scheduling priority.
SeIncreaseQuotaPrivilege Increase quotas.
SeInteractiveLogonRight Log on locally.
SeLoadDriverPrivilege Load and unload device drivers.
SeLockMemoryPrivilege Lock pages in memory.
SeMachineAccountPrivilege Add workstations to domain.
SeNetworkLogonRight Access this computer from the network.
SeProfileSingleProcessPrivilege Profile single process.
SeRemoteShutdownPrivilege Force shutdown from a remote system.
SeRestorePrivilege Restore files and directories.
SeSecurityPrivilege Manage auditing and security log.
SeServiceLogonRight Log on as a service.
SeShutdownPrivilege Shut down the system.
SeSystemEnvironmentPrivilege Modify firmware environment values.
SeSystemProfilePrivilege Profile system performance.
SeSystemtimePrivilege Change the system time.
SeTakeOwnershipPrivilege Take ownership of files or other objects.
SeTcbPrivilege Act as part of the operating system.
SeUnsolicitedInputPrivilege Read unsolicited input from a terminal device.

Windows NT Deny Rights

Using DumpSec.exe, formerly DumpACL.EXE, I have scripted UserRights.bat to display the User Rights Assignment on a specified computer, using a .CSV format.

The syntax for using UserRights.bat is:

UserRights ComputerName

Where ComputerName is the NetBIOS computer name that you want to enumerate.

The output is displayed on the console, each line containing:



"jsi009","SeInteractiveLogonRight","BUILTIN\Power Users","Log on locally"

UserRights.bat contains:

@echo off
If \{%1\}==\{\} @echo Syntax: UserRights ComputerName&goto :EOF
set computer=%1
set computer=%computer:"=%
set computer=%computer:\=%
set host=\\%computer%
set wrk=UserRights_%RANDOM%.CSV
dumpsec.exe /rpt=rights /saveas=csv /outfile=%wrk% /computer=%host%
for /f "Tokens=1-4 Delims=," %%a in ('type %wrk%^|Findstr /b /c:"Se"') do (
set acct=%%b#
set acct=!acct:  =!
set acct=!acct: #=!
set acct=!acct:#=!
set desc=%%c#
set desc=!desc:  =!
set desc=!desc: #=!
set desc=!desc:#=!
if "!desc!" EQU "" set desc=!acct!&set acct=NONE
@echo "%computer%","%%a","!acct!","!desc!"
del /q %wrk%

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.