Easiest way to grant/query “Log on as a service” to a Windows user from the command-line? (my question on Super User)
Posted by jpluimers on 2014/04/28
I want to script an install where a service needs to be run as a user. I want to be able to specify the user.
Creating the user is easy through the [Wayback/Archive] NET USER /ADD command.
Specifying the user for the service can also be done: the [Wayback/Archive] SC CONFIG command [Wayback/Archive] allows this (thanks [Wayback/Archive] wmz and [Wayback/Archive] ofiris).
Now the missing link: granting the user the [Wayback/Archive] “Log on as a service” privilege as a [Wayback/Archive] logon right (SeServiceLogonRight). Is there a command for this? Or a simple script for PowerShell?
(I know only Local Service can do this out of the box, and [Wayback/Archive] no other accounts by default are, but I want to have control over the account and what other privileges that account has).
Edit: solved. Thanks [Wayback/Archive] Mathias R. Jessen.
Here is the solution, including a few comments.
The easiest way to do this from a command line is definitely using NTRights.exe from the Windows Server 2003 Resource Toolkit.
ntrights +r SeServiceLogonRight -u jeroen -m \%COMPUTERNAME%
I changed the command-line a bit:
ntrights +r SeServiceLogonRight -u %USERNAME% -m \%COMPUTERNAME%
Note that
whoami /all
doesn’t show any change (not even after a reboot, it does not matter if you run it with or without UAC token).
secpol.msc
does show the change however, and does not require UAC (follow the tree to “Security Settings -> Local Policies -> User Rights Management -> Log on as a service” to see the users having the permission).
–jeroen
via: [Wayback/Archive] Easiest way to grant “Log on as a service” to a Windows user from the command-line? – Super User.
PS: Later I found out it is way easier to query the right:
accesschk.exe /accepteula -q -a SeServiceLogonRight
It will list the users having that right, for instance:
IIS APPPOOLClassic .NET AppPool
NT SERVICEALL SERVICES
VCS-CIContinuaCI
There are similar rights one might want to query:
SeBatchLogonRight SeDenyBatchLogonRight SeInteractiveLogonRight SeDenyInteractiveLogonRight SeServiceLogonRight SeDenyServiceLogonRight SeNetworkLogonRight SeDenyNetworkLogonRight
Thanks [Wayback/Archive] twasbrillig for explaining that at as answer to [Wayback/Archive] powershell – How to view user privileges using windows cmd? – Stack Overflow
The Wiert Corner - irregular stream of stuff 
Leave a Reply