15

I want to script an install where a service needs to be run as a user. I want to be able to specify the user.

Creating the user is easy through the NET USER /ADD command.

Specifying the user for the service can also be done: the SC CONFIG command allows this.

Now the missing link: granting the user the "Log on as a service" privilege as a logon right (SeServiceLogonRight). Is there a command for this? Or a simple script for PowerShell?

2 Answers 2

16

The easiest way to do this from a command line is definitely using NTRights.exe from the Windows Server 2003 Resource Toolkit.

ntrights +r SeServiceLogonRight -u jeroen -m \\%COMPUTERNAME%
6
  • 2
    An answer to this question - superuser.com/questions/309360/… - has a Powershell example.
    – LawrenceC
    Apr 28, 2014 at 14:36
  • @ultrasawblade thanks both of you; I'm going the NtRights route, but I'm glad there is a Plan-B when NtRights might become unavailable for one reason or another. Apr 28, 2014 at 19:26
  • ntrights +r SeServiceLogonRight -u %USERNAME% -m \\%COMPUTERNAME% works, but whoami /all doesn't show any change. secpol.msc does show the change however, so I have accepted your answer. Apr 28, 2014 at 19:43
  • Log out and log back in and whoami will list the new privilege Apr 28, 2014 at 19:44
  • @MathiasR.Jessen even after a reboot, whomai /all (with and without UAC token) list the right, but secpol.msc does. May 8, 2014 at 19:10
8

I use Carbon and Chocolatey.

cinst carbon -y

Grant-Privilege -Identity $username -Privilege SeServiceLogonRight

Based on this answer: https://stackoverflow.com/a/22155390/991267

6

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .