7

I am trying to write a script to list the privileges (eg SeShutDownPrivilege etc) of all user accounts. I'd prefer it if my script could be run as a standard user, but I can run it as an admin account if I had to. Here are the approaches I have tried so far:

  • using tokensz (from https://blogs.technet.microsoft.com/askds/2007/11/02/whats-in-a-token/): works (tokensz /compute_tokensize /dump_groups) for the currently logged in user. But when logged in even as a domain administrator, when trying for another user (tokensz /compute_tokensize /dump_groups /user:[another.user]), I get the error SEC_E_LOGON_DENIED

  • whoami /all works but only for the currently logged in user

  • ntrights.exe doesn't appear to be able to list privileges, only add and remove.

  • secedit /export /areas USER_RIGHTS /cfg out.txt: lists all privileges and the SIDs that have that privilege, but that list appears incomplete; the output from tokensz shows a user John.Smith with SeShutdownPrivilege, but the output from secedit for SeShutdownPrivilege lists groups that John.Smith is not a member of.

I can use portable executables (eg tokensz.exe, ntrights.exe) and built in utilities but will not be able to install applications or extensions

  • I believe your last proposal should really be secedit /export /mergedpolicy /areas USER_RIGHTS /cfg out.txt: this way it should list all the privileges that the security database will apply, should they come from the machine policies (as you got) as well as those granted through the Active Directory policies ("GPOs") – AntoineL Oct 29 '16 at 21:26
5

You can use AccessChk in accomplish this task.

Accesschk “domain\user” -a * will list all the permissions of a given domain user.

You can call this program within a PowerShell script, concatenate the results into a text file, then filter out just the permissions you want to know about.

5

For anybody looking for a PowerShell script, this ought to do it:

gwmi Win32_UserProfile | foreach-object {
 $sid = New-Object System.Security.Principal.SecurityIdentifier($_.SID)
 $user = $sid.Translate([System.Security.Principal.NTAccount])
 $username = $user.Value
 $username
 $chkCmd = "accesschk """ + $username + """ -a * -q"
 iex $chkCmd
 ""
}

It gets the list of users who have a profile on the local machine, determines their names from the SID, and invokes accesschk - as recommended by Ramhound - on them. Each user's record starts with the username in DOMAIN\user format, contains each right on a line, and ends with a blank line. (SID translation courtesy of this article.) You can dump its stuff to a file with the redirection operator, >.

A caveat of AccessChk is that it seems to produce an empty list for domain users that don't have local admin rights. Therefore, this version that produces the above information for every known user in the domain and on the machine is a little lame, but may become useful with a future version of the tool:

gwmi Win32_UserAccount | foreach-object {
 $username = $_.Caption
 $username
 $chkCmd = "accesschk """ + $username + """ -a * -q"
 iex $chkCmd
 ""
}

If you're wondering what secedit is talking about, it's just getting the list of principals (in SID form) to which the rights have been assigned in User Rights Assignment (see secpol.msc). Therefore, you'll usually see the SIDs for groups like Users or Administrators rather than specific people.

  • I approve of this answer. – Ramhound Apr 13 '16 at 17:17
  • My accesschk.exe does not list a -q option. Seems to be silently ignored. What is it supposed to do? – StackzOfZtuff Jun 26 '17 at 11:04
  • @StackzOfZtuff -q removes the banner with the name, version, copyright, and description of the tool, so accesschk only prints the stuff we need. I see it listed here on Accesschk v5.2, but somewhere along the way to v6.1 it seems to have been renamed to -nobanner. – Ben N Jun 26 '17 at 13:56
2

This script may help you. It offers the following functions, all using pure PowerShell:

  • Grant-UserRight
  • Revoke-UserRight
  • Get-UserRightsGrantedToAccount
  • Get-AccountsWithUserRight
  • Grant-TokenPrivilege
  • Revoke-TokenPrivilege

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.