Scripting Security Options and User Rights Assignment

[Brahnda Eleazar]

Peace all,

So far, I'm doing my hardening by using part scripting and part manually.

Is there a way to fully script the modification of Security Options and User Rights Assignment (Local Policy)?

My method as of now is to create a security template and after copying it to the WINDOWS\security\templates folder, I run the secedit command line.

The problem is that my security configuration in the template is not reflected in the Security Options and User Rights Assignments. I'm guessing this is due to different UIDs.

Is there a work around to this? Thanks a lot.

=adley=

[Edgar Zapata]

Hi,

First,
you need to edit your own security template:
secedit.exe /CFG Specifies a security template to import into the database prior to configuring the computer. Security templates are created using the Security Templates snap-in.

I was referred to this URL on "How to Configure local computer security using a command line" http://technet2.microsoft.com/WindowsServer/en/library/466c71c7-390a-4bf6-9bca-367251a04c301033.mspx?mfr=true
when I asked for a command to edit Local Security Policy. See http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1001351

Once you created your own security template through the security templates snap-in, you can then import the settings thru secedit /import.
Be careful with the /overwrite switch.

Is this what you're doing?
Does this help?

[Brahnda Eleazar]

Peace Edgar,

Actually what you're suggesting is what I'm doing. I'll take a look at those links and see if I can find something useful.

Well, so far I change my methods. I'm using sc command for services and ntrights for User Rights Assignment. I will run these commands after I run "secedit /configure" command to fix things up. There's only a bit problem to this plan. How do I know the computer's unique ID using command lines?

For example, Guest user has the ID *S-1-5-21--501. I hope those links have something about this.

Thanks again.

=adley=