Urgent: Adding users to log on locally list programmaticall y using C#

[abhishek.gilra]

Does anyone know how to add users to the log on locally list in User
Rights Management inside Local Security settings.

Thanks

[=?Utf-8?B?UGV0ZXIgQnJvbWJlcmcgW0MjIE1WUF0=?=]

Your question really has little to do with C# programming (that's the subject
of this group) but here goes:

open Local Security Settings from Administrative Tools, Computer Management
in Control Panel.

open the User Rights Assigment tree node.

Find the Log on Locally item in the Policy (right) window.

Double-click on this, and you can then add users or groups.

Next time, try to post to the relevant newsgroup. You're more likely to get
help.

--Peter

--
Site: http://www.eggheadcafe.com
UnBlog: http://petesbloggerama.blogspot.com
Short urls & more: http://ittyurl.net


"ab************ @gmail.com" wrote:

Does anyone know how to add users to the log on locally list in User
Rights Management inside Local Security settings.

Thanks

[=?Utf-8?B?UGV0ZXIgQnJvbWJlcmcgW0MjIE1WUF0=?=]

My apologies, you did say "programmatical ly". need to find the appropriate
WMI class to do this. For that, I can't help.
Peter

--
Site: http://www.eggheadcafe.com
UnBlog: http://petesbloggerama.blogspot.com
Short urls & more: http://ittyurl.net


"ab************ @gmail.com" wrote:

Does anyone know how to add users to the log on locally list in User
Rights Management inside Local Security settings.

Thanks

[Willy Denoyette [MVP]]

<ab************ @gmail.comwrote in message
news:11******** **************@ n76g2000hsh.goo glegroups.com.. .

Does anyone know how to add users to the log on locally list in User
Rights Management inside Local Security settings.

Thanks

All members of the "users", "administrators " and "guest" groups are
automatically allowed to log on locally. What other users were you thinking
off?

Willy.

[abhishek.gilra]

well. I am required to create a function that automates the following

start -settings -control panel -administrative tools -local
security policy -user assignment rights -find 'log on
locally' (open up properties) -add users or workgroups to that list.

hope that makes my question clear.

thanks

[abhishek.gilra]

Oh and I had test users in mind, so basically - "testuser1" for
example.

[Willy Denoyette [MVP]]

<ab************ @gmail.comwrote in message
news:11******** ************@n5 9g2000hsh.googl egroups.com...

Oh and I had test users in mind, so basically - "testuser1" for
example.

Well, actually there is nothing in the Framework that helps you with this.
So you will have to call into some WIn32 LSA API's using PInvoke.
Basically what you need to do is:
1. Get a LSA Policy handle for the target system, by calling LsaOpenPolicy.
2. Get the SID of the user account, by calling LsaLookupNames2
3. Add the "SeInteractiveL ogonRight" for the account, by means of a call to
LsaAddAccountRi ghts.
Note that LSA_UNICODE_STR ING type as used in these API's is not a CLR
string, it's a structure you need to initialize correctly before you call
the API's, watch out!.

But again, before you can grant this privilege to an account, the account
MUST exist, why not simply create the account and make it a member of the
"users" group or a group which already has the "Allow Logon Locally"
privilege"?

Willy.

[abhishek.gilra]

Thanks for the response Willy.

My initial plan was to add the user to a workgroup that was pre-
existing in the list, but then those workgroups might have privleges
which I would not want the users I create to have.

[Willy Denoyette [MVP]]

<ab************ @gmail.comwrote in message
news:11******** ************@o5 g2000hsb.google groups.com...

Thanks for the response Willy.

My initial plan was to add the user to a workgroup that was pre-
existing in the list, but then those workgroups might have privleges
which I would not want the users I create to have.

But you are talking about local accounts, I don't think you have tens of
these on a local machine don't you?
If you are running in a Windows domain, you can achieve what you want by
applying Group Policy Management.

Willy.

[abhishek.gilra]

On May 8, 6:29 am, "Willy Denoyette [MVP]"
<willy.denoye.. [e-mail] te:

<abhishek.gi... @gmail.comwrote in message

news:11******** ************@n5 9g2000hsh.googl egroups.com...

Oh and I had testusersin mind, so basically - "testuser1" for
example.

Well, actually there is nothing in the Framework that helps you with this.
So you will have to call into some WIn32 LSA API's using PInvoke.
Basically what you need to do is:
1. Get a LSA Policy handle for the target system, by calling LsaOpenPolicy.
2. Get the SID of the user account, by calling LsaLookupNames2
3. Add the "SeInteractiveL ogonRight" for the account, by means of a call to
LsaAddAccountRi ghts.
Note that LSA_UNICODE_STR ING type as used in these API's is not a CLR
string, it's a structure you need to initialize correctly before you call
the API's, watch out!.

But again, before you can grant this privilege to an account, the account
MUST exist, why not simply create the account and make it a member of the
"users" group or a group which already has the "Allow Logon Locally"
privilege"?

Willy.

I did that and it says -- "specified privilege does not exist" for
"SeInteractiveL ogonRight"