USER_RIGHTS_POLICY

This policy item checks for the following value defined in Security Settings > Local Policies > User Rights Assignment. The check is performed by calling the function LsaEnumerateAccountsWithUserRight on the LSA policy handle.

Usage

Note: User rights tests perform many requests against the domain controller. These tests must be included in a separate policy file and only launched against the Domain Controller and ONE system of the domain.

right_type

The right_type field corresponds to the right to test. Allowed values are:

right_type: RIGHT

Note: There must be no quotes around the RIGHT type as it is parsed as a token.

Where RIGHT can be:

SeAssignPrimaryTokenPrivilege

SeAuditPrivilege

SeBackupPrivilege

SeBatchLogonRight

SeChangeNotifyPrivilege

SeCreateGlobalPrivilege

SeCreatePagefilePrivilege

SeCreatePermanentPrivilege

SeCreateTokenPrivilege

SeDenyBatchLogonRight

SeDenyInteractiveLogonRight

SeDenyNetworkLogonRight

SeDenyRemoteInteractiveLogonRight

SeDenyServiceLogonRight

SeDebugPrivilege

SeEnableDelegationPrivilege

SeImpersonatePrivilege

SeIncreaseBasePriorityPrivilege

SeIncreaseWorkingSetPrivilege

SeIncreaseQuotaPrivilege

SeInteractiveLogonRight

SeLoadDriverPrivilege

SeLockMemoryPrivilege

SeMachineAccountPrivilege

SeManageVolumePrivilege

SeNetworkLogonRight

SeProfileSingleProcessPrivilege

SeRemoteShutdownPrivilege

SeRemoteInteractiveLogonRight

SeRelabelPrivilege

SeRestorePrivilege

SeSecurityPrivilege

SeServiceLogonRight

SeShutdownPrivilege

SeSyncAgentPrivilege

SeSystemEnvironmentPrivilege

SeSystemProfilePrivilege

SeSystemTimePrivilege

SeTakeOwnershipPrivilege

SeTcbPrivilege

SeTimeZonePrivilege

SeUndockPrivilege

SeUnsolicitedInputPrivilege

value_type

value_type: USER_RIGHT

value_data

value_data: "user1" && "user2" && "group1" && ... && "groupn"

use_domain

The use_domain option is used to add the account domain names to the output of the check.

If you set use_domain to YES, you must modify value_data to include the Windows domain the user or group is a member of.

For example, value_data: "BUILTIN\Administrators" && "NT SERVICE\WdiServiceHost"

Example