Users in Windows can be granted various privileges
Privileges determine the type of system operations that a user account can perform. An administrator assigns privileges to user and group accounts. Each user's privileges include those granted to the user and to the groups to which the user belongs.
There are currently 35 privileges. Some of the more interesting ones are:
- SeSystemtimePrivilege: Required to modify the system time.
- SeTimeZonePrivilege: Required to adjust the time zone associated with the computer's internal clock
- SeBackupPrivilege: This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file.
- SeCreatePagefilePrivilege: Required to create a paging file.
- SeRemoteShutdownPrivilege: Required to shut down a system using a network request.
- SeDebugPrivilege: Required to debug and adjust the memory of a process owned by another account.
But the one I'm interested in is:
- SeShutdownPrivilege: Required to shut down a local system.
I noticed that I don't actually have this privilege. From an elevated command prompt:
>whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
=============================== ========================================= ========
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeSecurityPrivilege Manage auditing and security log Disabled
SeTakeOwnershipPrivilege Take ownership of files or other objects Disabled
...
SeShutdownPrivilege Shut down the system Disabled
...
This is confirmed when using Process Explorer to examine the security token of an elevated process running as me:
And yet I can shut down the system. Why?
The Group Policy says I should have it
If you use the Local Security Policy editor snapin (secpol.msc
), you can see that I should have the privilege:
The Explaination of the privilege:
Shut down the system
This security setting determines which users who are logged on locally to the computer can shut down the operating system using the Shut Down command. Misuse of this user right can result in a denial of service.
Default on Workstations: Administrators, Backup Operators, Users.
Default on Servers: Administrators, Backup Operators.
Default on Domain controllers: Administrators, Backup Operators, Server Operators, Print Operators.
I'm a User. Sometimes I'm an Administrator, and other times I'm a NotAdministrator.
Perhaps the question should be why don't I have the privilege.
But the reality is that I don't have the privilege; and yet when locally logged in I can shut down the local system.
Why?
@Mehrdad had a good answer, that he deleted, which i think deserves attention and answers the question nicely and succinctly:
You have the privilege. It's merely disabled by default. If you didn't have the privilege then it wouldn't be listed at all.
Notice thatSE_PRIVILEGE_REMOVED
is different from lackingSE_PRIVILEGE_ENABLED
orSE_PRIVILEGE_ENABLED_BY_DEFAULT
.
Bonus Reading
- MSDN: Privilege Constants
- Technet: Shut down the system - user right assignment