Re: Setting Act As Part of Operating System - VBScript

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 02/27/05


Date: Sun, 27 Feb 2005 08:22:14 -0700


"Herb Martin" <news@LearnQuick.com> wrote in message
news:u87gZwDHFHA.3376@TK2MSFTNGP14.phx.gbl...
> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> news:eLwBE5AHFHA.432@TK2MSFTNGP09.phx.gbl...
> > Herb,
> >
> > I regularly give the news in the scripting NG.
> > There is no programmatic interface available to script
> > for setting the value of a policy, including User Rights.
> > It can be done from lower-level like C++ for rights,
> > but in general there is no public API set for manipulating
> > the values of policies.
>
> I don't know how "policies" got in here, but
> after thinking about it this seems to make much
> more sense if he just creates a group and uses
> the scripting to add them to the group.
>
> That is easy and even the right way to grant
> rights and other privileges anyway.
>
> --
> Herb Martin
>

Herb,

Beginning with W2k User Rights is a section in the
local security policy, and in all GPOs.
There is no API for setting any policy values from script.

What you state about use of a group is absolutely
right. However, that only chases the posters issue
back one level: does group exist yet, and has it been
granted the user right? If not, the installer would need
to make it so. For that OP would need to resort to
shelling out from their script to an exe like NTrights.

-- 
Roger
> > "Herb Martin" <news@LearnQuick.com> wrote in message
> > news:OiAoAp6GFHA.3536@TK2MSFTNGP14.phx.gbl...
> > > "Jason" <Jason@discussions.microsoft.com> wrote in message
> > > news:ACF5AD77-66DA-4135-95A9-FA9B9ED759DB@microsoft.com...
> > > > I only want it for one user.  How do I do this in VBScript?  Once
> again
> > > I'm a
> > > > newbie to VBScripting.
> > > >
> > >
> > > You might do better posting such a question
> > > to a scripting/VBS/adsi forum.
> > >
> > > I could go look it up but don't know how to
> > > do it off the top of my head like some of those
> > > folks might.
> > >
> > > My first approach would be to search MS Dev
> > > areas using Google with something like:
> > >
> > >     [ vbscript assign rights users site:microsoft.com ]
> > >
> > > Or even site:msdn.microsoft.com  or maybe microsoft:
> > >
> > > I would also check the ADSI Scriptomatic (stick those
> > > words into the site searchs above instead of the other
> > > key words -- or in addition.)
> > >
> > >
> > > -- 
> > > Herb Martin
> > >
> > >
> > > > "Herb Martin" wrote:
> > > >
> > > > > "Jason" <Jason@discussions.microsoft.com> wrote in message
> > > > > news:8ACA55EB-0E77-4123-89E2-0C237A46D8E8@microsoft.com...
> > > > > > I would like to be able to set any given user that I just
created
> to
> > > have
> > > > > the
> > > > > > right "Act as part of the operating system" using a VBSCript.
I'm
> a
> > > > > complete
> > > > > > newbie to VBScripting and I'm told this would be the only way to
> get
> > > this
> > > > > > functionality into my installshield.  Any suggestions?
> > > > >
> > > > > Sounds like a bad idea but you can give this right
> > > > > to a user or group (where you create the security
> > > > > principal.)
> > > > >
> > > > > A Group Policy can also do this.
> > > > >
> > > > > -- 
> > > > > Herb Martin
> > > > >
> > > > >
> > > > >
> > > > >
> > >
> > >
> >
> >
>
>


Relevant Pages

  • Re: Setting Act As Part of Operating System - VBScript
    ... "Roger Abell" wrote in message ... User Rights are policies, and there is no script ... >> "Herb Martin" wrote: ...
    (microsoft.public.win2000.security)
  • Re: Any way to tell if a user hasnt logged in for a set period of time?
    ... Well a simple Perl script could drop all users that don't ... > domain controller with the /s switch to get a list of suspects. ... > "Herb Martin" wrote in message ...
    (microsoft.public.win2000.networking)
  • Re: scripted logon
    ... Why can't you launch all the scripts from a Group Policy based Logon script. ... Here's the policy settings (I sure hope word wrap doesn't mess it up too ... Windows Components/Windows Installer ...
    (microsoft.public.windows.terminal_services)
  • Re: Group Policy Timeout on one server in an OU.
    ... inheritance of that login script and placed myself in the OU. ... On Error GoTo 0 ... Group Policy Information Hub: ... Group Policy Management solutions athttp://www.sdmsoftware.com ...
    (microsoft.public.windows.group_policy)
  • Re: Startup Bat File
    ... Link the policy at/above where their accounts reside in the AD tree. ... So it looks like it needs to be moved to the logon script within the ... registry settings and such for mapping drives, ... Domain Admins - Read, Write, Create All Child Objects, Delete All ...
    (microsoft.public.windows.group_policy)