Although the built-in capabilities for accounts cannot be changed, user rights for accounts can be administered. These rights authorize users to perform specific actions, such as logging on to a system interactively or backing up files and directories. User rights are different from permissions because they apply to user accounts, whereas permissions are attached to objects. Keep in mind that changes made to user rights can have a far-reaching effect. Because of this, only experienced administrators should make changes to the user rights policy.
Microsoft defines user rights in two types of categories: Logon Rights and Privileges. These are defined as follows:
Logon Right: A user right that is assigned to a user and that specifies the ways in which a user can log onto a system. An example of a logon right is the right to log on to a system remotely.
Privilege: A user right that is assigned to a user and that specifies allowable actions on the system. An example of a privilege is the right to shut down a system.
User rights define capabilities at the local level. Although they can apply to individual user accounts, user rights are best administered on a group account basis. This ensures that a user logging on as a member of a group automatically inherits the rights associated with that group. By assigning rights to groups rather than individual users, user account administration can be simplified. When users in a group all require the same user rights, they can be assigned the set of rights once to the group, rather than repeatedly assigning the same set to each individual user account.
User rights that are assigned to a group are applied to all members of the group while they remain members. If a user is a member of multiple groups, the user's rights are cumulative, which means that the user has more than one set of rights and privileges. The only time that rights assigned to one group might conflict with those assigned to another is in the case of certain logon rights. For example a member of multiple groups who is given the "Deny Access to This Computer from the Network" logon right would not be able to log on despite the logon rights granted to the user by other groups. The user would be logged on locally with cached credentials, but when attempting to access the domain resources would receive the following message:
In general, however, user rights assigned to one group do not conflict with the rights assigned to another group. To remove rights from a user, the administrator simply removes the user from the group. In this case, the user no longer has the rights assigned to that group.
The following lists show the logon rights and privileges that can be assigned to a user.
Some of the privileges can override permissions set on an object. For example, a user logged on to a domain account as a member of the Backup Operators group has the right to perform backup operations for all domain servers. However, this requires the ability to read all files on those servers, even files on which their owners have set permissions that explicitly deny access to all other users, including members of the Backup Operators group. A user privilege, in this case, the right to perform a backup, takes precedence over all file and directory permissions. The privileges, which can override permissions set on an object, are listed below.
Take Ownership of Files or Other Object
Manage Auditing and Security Log
Back Up Files and Directories
Restore Files and Directories
Bypass Traverse Checking
The Take Ownership of Files or Other Object (TakeOwnership) privilege grants WriteOwner access to an object. Backup and Restore privileges grant read and write access to an object. The Debug Programs (debug) privilege grants read or open access to an object. The Bypass Traverse Checking (ChangeNotify) privilege provides the reverse access on directories. This privilege is given, by default, to all users and is not considered security relevant. The Manage Auditing and Security Log (Security) privilege provides several abilities including access to the security log, overriding access restrictions to the security log. The Event Logger is responsible for enforcing the Security privilege in this context. The TakeOwnership, Security, Backup, Restore, Debug privileges should only be assigned to administrator accounts (See Appendix C, User Rights and Privileges, of the Windows 2000 Security Configuration Guide, for the restrictions of the assignment of privileges to be in accordance with the Evaluated Configuration).
The special user account LocalSystem has almost all privileges and logon rights assigned to it, because all processes that are running as part of the operating system are associated with this account, and these processes require a complete set of user rights.
Appendix C – User Rights and Privileges, of the Windows 2000 Security Configuration Guide, contains a cross-reference table of user rights and privileges to applicable Security Target requirements that should be used as reference when implementing a user rights policy that must address specific ST requirements.
Assigning User Rights
User rights are assigned through the Local Policies node of Group Policy. As the name implies, local policies pertain to a local computer. However, local policies can be configured and then imported into Active Directory. Local policies can also be configured as part of an existing Group Policy for a site, domain, or organizational unit. When this is done, the local policies will apply to computer accounts in the site, domain, or organizational unit.
User rights policies can be administered as follows:
Log on using an administrator account.
Open the Active Directory Users and Computers tool.
Right-click the container holding the domain controller and click Properties.
Click the Group Policy tab, and then click Edit to edit the Default Domain Policy.
In the Group Policy window, expand Computer Configuration, navigate to Windows Settings, to Security Settings, and then to Local Policies.
Select User Rights Assignment.
Note: All policies are either defined or not defined. That is, they are either configured for use or not configured for use. A policy that is not defined in the current container could be inherited from another container.
To configure user rights assignment, double-click a user right or right-click on it and select Security. This opens a Security Policy Setting dialog box.
For a site, domain, or organizational unit, individual user rights can be configured by completing the following steps:
Open the Security Policy Setting dialog box for the user right to be modified.
Select Define these policy settings to define the policy.
To apply the right to a user or group, click Add.
In the Add user or group dialog box, click Browse. This opens the Select Users Or Groups dialog box. The right can now be applied to users and groups.
The following selection options appear on the Select Users Or Groups box:
Name: The Name column shows the available accounts of the currently selected domain or resource.
Add: Add selected names to the selection list.
Check Names: Validate the user and group names entered into the selection list. This is useful if names are typed in manually and it is necessary ensure that they're actually available.
To access account names from other domains, click the Look In list box. A drop-down list will appear that shows the current domain, trusted domains, and other resources that can be accessed. Select Entire Directory to view all the account names in the directory.
Note: Only domains that have been designated as trusted are available in the Look In drop-down list. Because of the transitive trusts in Windows 2000, this usually means that all domains in the domain tree or forest are listed. A transitive trust is one that is not established explicitly. Rather, the trust is established automatically based on the forest structure and permissions set in the forest.
After selecting the account names to add to the group, click OK. The Add user or group dialog box should now show the selected accounts. Click OK again.
The Security Policy Setting dialog box is updated to reflect the selections. If a mistake is made, select a name and remove it by clicking Remove.
When finished granting the right to users and groups, click OK.
Top Of Page
Configuring Local User Rights
For local computers, such as Windows 2000 Professional, apply user rights by completing the following steps:
Log in as Administrator.
Open Start, point to Programs, point to Administrative Tools, and then click Local Security Policy.
In the Local Security Settings window, navigate to Local Policies, and then select User Rights Assignment.
To configure user rights assignment, double-click a user right or right-click on it and select Security. This opens a Security Policy Setting dialog box. The effective policy for the computer is displayed, but it cannot be changed. However, the local policy settings can be adjusted. Use the fields provided to configure the local policy. Remember that site, domain, and organizational unit policies have precedence over local policies.
The Assigned To column shows current users and groups that have been given a user right. Select or clear the related check boxes under the Local Policy Setting column to apply or remove the user right.
Apply the user right to additional users and groups by clicking Add. This opens the Select Users Or Groups dialog box. Local users and groups can now be added.
To access account names from the domain, click the Look In list box. There should be a list that shows the current machine, the local domain, trusted domains, and other resources that can be accessed. Select the local domain to view all the account names in the domain.
Top Of Page
How to Add or Remove Users and Groups from "User Rights Assignment" in Windows
User Rights Assignment policies determines which users or groups have logon rights or privileges on the computer. This will show you how to add (assign) or remove users and groups for each User Rights Assignment policy in Vista, Windows 7, or Windows 8.
You must be logged in as an administrator to be able to do the steps in this tutorial.
If you remove a user or group, then that user or group will no longer be able to perform the policy on the computer.
If you add a user or group, then that user or group will now be able to perform the policy on the computer.
For more information about each specific user rights policy, see: User Rights
This tutorial is not for a beginner to try.
I would highly recommend that you create a restore point before making changes to the User Rights Assignment. This way if you make a mistake and lock yourself, a user, or a group out of a policy that you didn't want to, you will be able to do a system restore at boot and select the restore point to undo the mistake.
1. Open the Local Security Policy window, expand Local Policies in the left pane, and select User Rights Assignment. (see screenshot below)2. In the right pane of User Rights Assignment, double click on a listed Policy (ex: Shut down the system) that you wanted to add or remove a user or group, then go to step 3 and/or 4 below. (see screenshot above)
3. To Remove a User or Group from a User Rights Assignment Policy
A) Select (highlight) a listed user(s) and/or group(s) that you wanted to remove from the policy, then click on the Remove button. (see screenshot below)4. To Add a User or Group to a User Rights Assignment Policy
NOTE:You can press and hold the CTRL key to select more than one listed user (user account name) and/or group.B) Click on Apply. (see screenshot below)C) Go to step 4 or 5 for what you would like to do.A) Click on the Add User or Group button. (see screenshot above)
B) Click on the Advanced button. (see screenshot below)C) Click on the Object Types button. (see screenshot below)D) Check only the Users and Groups boxes, and click on OK. (see screenshot below)E) Click on the Find Now button. (see screenshot below)F) In the bottom pane under Search results, select the user(s) and/or group(s) that you wanted to add to the policy, then click on OK. (see screenshot below)
NOTE:You can press and hold the CTRL key to select more than one listed user (user account name) and/or group.G) Click on OK. (see screenshot below)H) Click on Apply. (see screenshot below)
5. When finished, click on OK. (see screenshots below steps 3B and 4H)
6. Close the Local Security Policy window. (see screenshot below step 1)
1. If you have not already, click on the Download button below to download the ntrights.zip file originally from within the Windows Server 2003 Resource Kit Tools.
2. Open an elevated command prompt, and do step 3 and/or 4 below.
A) Open the downloaded .zip file, and extract (drag and drop) the ntrights.exe file to your desktop.
B) Right click on the ntrights.exe file, click on Properties, General tab, and click on the Unblock button if available.
NOTE:If you do not have a Unblock button under the General tab, then the file is already unblocked and you can continue on to step 1C.
C) Right click on the ntrights.exe file and click on Move.
D) Open Windows Explorer and navigate to and open the C:\Windows\System32 folder, then Paste the ntrights.exe file to move it here.
E) If prompted, click on Continue and Yes to approve moving the ntrights.exe file into the System32 folder, then close the Windows Explorer window.
3. To Remove a User or Group from a User Rights Assignment PolicyA) In the elevated command prompt, type the command below for what user or group that you would like to remove from what policy, and press Enter.4. To Add a User or Group to a User Rights Assignment Policy
NOTE:See blue note box below step 4.ntrights -U "User or Group" -R PolicyConstantNameFor example:If I wanted to remove the standard users group "Users" from being able to "Shut down the system", then I would type the command below.B) Go to step 4 or 5 for what you would like to do.
ntrights -U "Users" -R SeShutdownPrivilege
That's it,A) In the elevated command prompt, type the command below for what user or group that you would like to add to what policy, and press Enter.
NOTE:See blue note box below step 4.ntrights -U "User or Group" +R PolicyConstantNameFor example:If I wanted to add the standard users group "Users" to be able to "Shut down the system", then I would type the command below.
ntrights -U "Users" +R SeShutdownPrivilegeNote
Substitute User or Group in the command with actual name of the user account or group within quotes.
Substitute PolicyConstantName in the command for the actual Constant Name at the link below for the Group Policy Name that you wanted to add or remove a user or group.User Rights
5. When finished, close the elevated command prompt.