Setting Act As Part of Operating System - VBScript

[Guest]

I would like to be able to set any given user that I just created to have the
right "Act as part of the operating system" using a VBSCript. I'm a complete
newbie to VBScripting and I'm told this would be the only way to get this
functionality into my installshield. Any suggestions?

 

[Herb Martin]

I would like to be able to set any given user that I just created to have the
right "Act as part of the operating system" using a VBSCript. I'm a complete
newbie to VBScripting and I'm told this would be the only way to get this
functionality into my installshield. Any suggestions?

Sounds like a bad idea but you can give this right
to a user or group (where you create the security
principal.)

A Group Policy can also do this.

 

[Guest]

I only want it for one user. How do I do this in VBScript? Once again I'm a
newbie to VBScripting.

 

[Roger Abell]

I will also say that this sounds like a bad thing to do.

That said, there is no direct way to grant user rights to accounts
from script in Windows 2000 and later. You can however
shell out to an execution of such as NTrights.exe from the
resource kit. User Rights are policies, and there is no script
interface for setting the values of policies.

 

[Herb Martin]

I only want it for one user. How do I do this in VBScript? Once again I'm a
newbie to VBScripting.

You might do better posting such a question
to a scripting/VBS/adsi forum.

I could go look it up but don't know how to
do it off the top of my head like some of those
folks might.

My first approach would be to search MS Dev
areas using Google with something like:

[ vbscript assign rights users site:microsoft.com ]

Or even site:msdn.microsoft.com or maybe microsoft:

I would also check the ADSI Scriptomatic (stick those
words into the site searchs above instead of the other
key words -- or in addition.)

 

[Herb Martin]

I will also say that this sounds like a bad thing to do.

That said, there is no direct way to grant user rights to accounts
from script in Windows 2000 and later. You can however
shell out to an execution of such as NTrights.exe from the
resource kit. User Rights are policies, and there is no script
interface for setting the values of policies.

I don't know about it being impossible but
even ignoring the security issue from a management
point of view it is better to do it another way
(and easier to program):

Build a GROUP for this purpose -- give it all
rights and privileges the "users" will need.

Then have the script put the user in that group.

(User will need to re-logon for it to take effect
but that is true for direct rights assingment anyway.)

 

[Roger Abell]

Herb,

I regularly give the news in the scripting NG.
There is no programmatic interface available to script
for setting the value of a policy, including User Rights.
It can be done from lower-level like C++ for rights,
but in general there is no public API set for manipulating
the values of policies.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA

I only want it for one user. How do I do this in VBScript? Once again I'm a
newbie to VBScripting.

You might do better posting such a question
to a scripting/VBS/adsi forum.

I could go look it up but don't know how to
do it off the top of my head like some of those
folks might.

My first approach would be to search MS Dev
areas using Google with something like:

[ vbscript assign rights users site:microsoft.com ]

Or even site:msdn.microsoft.com or maybe microsoft:

I would also check the ADSI Scriptomatic (stick those
words into the site searchs above instead of the other
key words -- or in addition.)

 

[Herb Martin]

Herb,

I regularly give the news in the scripting NG.
There is no programmatic interface available to script
for setting the value of a policy, including User Rights.
It can be done from lower-level like C++ for rights,
but in general there is no public API set for manipulating
the values of policies.

I don't know how "policies" got in here, but
after thinking about it this seems to make much
more sense if he just creates a group and uses
the scripting to add them to the group.

That is easy and even the right way to grant
rights and other privileges anyway.

--
Herb Martin

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA

I only want it for one user. How do I do this in VBScript? Once

again
I'm a

newbie to VBScripting.

You might do better posting such a question
to a scripting/VBS/adsi forum.

I could go look it up but don't know how to
do it off the top of my head like some of those
folks might.

My first approach would be to search MS Dev
areas using Google with something like:

[ vbscript assign rights users site:microsoft.com ]

Or even site:msdn.microsoft.com or maybe microsoft:

I would also check the ADSI Scriptomatic (stick those
words into the site searchs above instead of the other
key words -- or in addition.)


--
Herb Martin

:

I would like to be able to set any given user that I just created

to
have

the
right "Act as part of the operating system" using a VBSCript. I'm a
complete
newbie to VBScripting and I'm told this would be the only way to

get
this

functionality into my installshield. Any suggestions?

Sounds like a bad idea but you can give this right
to a user or group (where you create the security
principal.)

A Group Policy can also do this.

 

[Roger Abell]

I don't know how "policies" got in here, but
after thinking about it this seems to make much
more sense if he just creates a group and uses
the scripting to add them to the group.

That is easy and even the right way to grant
rights and other privileges anyway.

Herb,

Beginning with W2k User Rights is a section in the
local security policy, and in all GPOs.
There is no API for setting any policy values from script.

What you state about use of a group is absolutely
right. However, that only chases the posters issue
back one level: does group exist yet, and has it been
granted the user right? If not, the installer would need
to make it so. For that OP would need to resort to
shelling out from their script to an exe like NTrights.

--
Roger

I only want it for one user. How do I do this in VBScript? Once again
I'm a
newbie to VBScripting.


You might do better posting such a question
to a scripting/VBS/adsi forum.

I could go look it up but don't know how to
do it off the top of my head like some of those
folks might.

My first approach would be to search MS Dev
areas using Google with something like:

[ vbscript assign rights users site:microsoft.com ]

Or even site:msdn.microsoft.com or maybe microsoft:

I would also check the ADSI Scriptomatic (stick those
words into the site searchs above instead of the other
key words -- or in addition.)


--
Herb Martin


:

I would like to be able to set any given user that I just

created

to

I'm

a

 

[Guest]

My script first creates the user. Then I assign rights like "Act as part
of the operating system" As for groups I don't need to create one. I just
need to specify rights for this one user. So you're saying I can only do
this in C++ with WMI API?

Wheter it's wise or not doesn't matter to me. I'm developing an install
shield to do this preinstallation requirements for a third party Software
that requires this specific user with those rights.

I'm really having a hard time figuring out how to automate this task. I've
tried everything in Google.

I don't know how "policies" got in here, but
after thinking about it this seems to make much
more sense if he just creates a group and uses
the scripting to add them to the group.

That is easy and even the right way to grant
rights and other privileges anyway.

Herb,

Beginning with W2k User Rights is a section in the
local security policy, and in all GPOs.
There is no API for setting any policy values from script.

What you state about use of a group is absolutely
right. However, that only chases the posters issue
back one level: does group exist yet, and has it been
granted the user right? If not, the installer would need
to make it so. For that OP would need to resort to
shelling out from their script to an exe like NTrights.

--
Roger

I only want it for one user. How do I do this in VBScript? Once again
I'm a
newbie to VBScripting.


You might do better posting such a question
to a scripting/VBS/adsi forum.

I could go look it up but don't know how to
do it off the top of my head like some of those
folks might.

My first approach would be to search MS Dev
areas using Google with something like:

[ vbscript assign rights users site:microsoft.com ]

Or even site:msdn.microsoft.com or maybe microsoft:

I would also check the ADSI Scriptomatic (stick those
words into the site searchs above instead of the other
key words -- or in addition.)


--
Herb Martin


:

I would like to be able to set any given user that I just

created

to
have
the
right "Act as part of the operating system" using a VBSCript.

I'm

a
complete
newbie to VBScripting and I'm told this would be the only way to get
this
functionality into my installshield. Any suggestions?

Sounds like a bad idea but you can give this right
to a user or group (where you create the security
principal.)

A Group Policy can also do this.

 

[Guest]

Thanks guys. I did it in C++ just fine. I was looking for a way in
VBScript but it just doesn't seem to be out there.

I don't know how "policies" got in here, but
after thinking about it this seems to make much
more sense if he just creates a group and uses
the scripting to add them to the group.

That is easy and even the right way to grant
rights and other privileges anyway.

Herb,

Beginning with W2k User Rights is a section in the
local security policy, and in all GPOs.
There is no API for setting any policy values from script.

What you state about use of a group is absolutely
right. However, that only chases the posters issue
back one level: does group exist yet, and has it been
granted the user right? If not, the installer would need
to make it so. For that OP would need to resort to
shelling out from their script to an exe like NTrights.

--
Roger

I only want it for one user. How do I do this in VBScript? Once again
I'm a
newbie to VBScripting.


You might do better posting such a question
to a scripting/VBS/adsi forum.

I could go look it up but don't know how to
do it off the top of my head like some of those
folks might.

My first approach would be to search MS Dev
areas using Google with something like:

[ vbscript assign rights users site:microsoft.com ]

Or even site:msdn.microsoft.com or maybe microsoft:

I would also check the ADSI Scriptomatic (stick those
words into the site searchs above instead of the other
key words -- or in addition.)


--
Herb Martin


:

I would like to be able to set any given user that I just

created

to
have
the
right "Act as part of the operating system" using a VBSCript.

I'm

a
complete
newbie to VBScripting and I'm told this would be the only way to get
this
functionality into my installshield. Any suggestions?

Sounds like a bad idea but you can give this right
to a user or group (where you create the security
principal.)

A Group Policy can also do this.

 

[Roger Abell]

Thanks guys. I did it in C++ just fine. I was looking for a way in
VBScript but it just doesn't seem to be out there.

It isn't

--
Roger

Herb,

I regularly give the news in the scripting NG.
There is no programmatic interface available to script
for setting the value of a policy, including User Rights.
It can be done from lower-level like C++ for rights,
but in general there is no public API set for manipulating
the values of policies.

I don't know how "policies" got in here, but
after thinking about it this seems to make much
more sense if he just creates a group and uses
the scripting to add them to the group.

That is easy and even the right way to grant
rights and other privileges anyway.

Herb,

Beginning with W2k User Rights is a section in the
local security policy, and in all GPOs.
There is no API for setting any policy values from script.

What you state about use of a group is absolutely
right. However, that only chases the posters issue
back one level: does group exist yet, and has it been
granted the user right? If not, the installer would need
to make it so. For that OP would need to resort to
shelling out from their script to an exe like NTrights.

--
Roger

I only want it for one user. How do I do this in VBScript? Once
again
I'm a
newbie to VBScripting.


You might do better posting such a question
to a scripting/VBS/adsi forum.

I could go look it up but don't know how to
do it off the top of my head like some of those
folks might.

My first approach would be to search MS Dev
areas using Google with something like:

[ vbscript assign rights users site:microsoft.com ]

Or even site:msdn.microsoft.com or maybe microsoft:

I would also check the ADSI Scriptomatic (stick those
words into the site searchs above instead of the other
key words -- or in addition.)


--
Herb Martin


:

I would like to be able to set any given user that I just created
to
have
the
right "Act as part of the operating system" using a

VBSCript.
I'm

a
complete
newbie to VBScripting and I'm told this would be the only way to
get
this
functionality into my installshield. Any suggestions?

Sounds like a bad idea but you can give this right
to a user or group (where you create the security
principal.)

A Group Policy can also do this.