Urgent: Adding users to log on locally list programmatically using C#

[abhishek.gilra]

Does anyone know how to add users to the log on locally list in User
Rights Management inside Local Security settings.

Thanks

[=?Utf-8?B?UGV0ZXIgQnJvbWJlcmcgW0MjIE1WUF0=?=]

Your question really has little to do with C# programming (that's the subject
of this group) but here goes:

open Local Security Settings from Administrative Tools, Computer Management
in Control Panel.

open the User Rights Assigment tree node.

Find the Log on Locally item in the Policy (right) window.

Double-click on this, and you can then add users or groups.

Next time, try to post to the relevant newsgroup. You're more likely to get
help.

--Peter

--
Site: http://www.eggheadcafe.com
UnBlog: http://petesbloggerama.blogspot.com
Short urls & more: http://ittyurl.net


"ab************@gmail.com" wrote:

Does anyone know how to add users to the log on locally list in User
Rights Management inside Local Security settings.

Thanks

[=?Utf-8?B?UGV0ZXIgQnJvbWJlcmcgW0MjIE1WUF0=?=]

My apologies, you did say "programmatically". need to find the appropriate
WMI class to do this. For that, I can't help.
Peter

--
Site: http://www.eggheadcafe.com
UnBlog: http://petesbloggerama.blogspot.com
Short urls & more: http://ittyurl.net


"ab************@gmail.com" wrote:

Does anyone know how to add users to the log on locally list in User
Rights Management inside Local Security settings.

Thanks

[Willy Denoyette [MVP]]

<ab************@gmail.comwrote in message
news:11**********************@n76g2000hsh.googlegr oups.com...

Does anyone know how to add users to the log on locally list in User
Rights Management inside Local Security settings.

Thanks

All members of the "users", "administrators" and "guest" groups are
automatically allowed to log on locally. What other users were you thinking
off?

Willy.

[abhishek.gilra]

well. I am required to create a function that automates the following

start -settings -control panel -administrative tools -local
security policy -user assignment rights -find 'log on
locally' (open up properties) -add users or workgroups to that list.

hope that makes my question clear.

thanks

[abhishek.gilra]

Oh and I had test users in mind, so basically - "testuser1" for
example.

[Willy Denoyette [MVP]]

<ab************@gmail.comwrote in message
news:11********************@n59g2000hsh.googlegrou ps.com...

Oh and I had test users in mind, so basically - "testuser1" for
example.

Well, actually there is nothing in the Framework that helps you with this.
So you will have to call into some WIn32 LSA API's using PInvoke.
Basically what you need to do is:
1. Get a LSA Policy handle for the target system, by calling LsaOpenPolicy.
2. Get the SID of the user account, by calling LsaLookupNames2
3. Add the "SeInteractiveLogonRight" for the account, by means of a call to
LsaAddAccountRights.
Note that LSA_UNICODE_STRING type as used in these API's is not a CLR
string, it's a structure you need to initialize correctly before you call
the API's, watch out!.

But again, before you can grant this privilege to an account, the account
MUST exist, why not simply create the account and make it a member of the
"users" group or a group which already has the "Allow Logon Locally"
privilege"?

Willy.

[abhishek.gilra]

Thanks for the response Willy.

My initial plan was to add the user to a workgroup that was pre-
existing in the list, but then those workgroups might have privleges
which I would not want the users I create to have.

[Willy Denoyette [MVP]]

<ab************@gmail.comwrote in message
news:11********************@o5g2000hsb.googlegroup s.com...

Thanks for the response Willy.

My initial plan was to add the user to a workgroup that was pre-
existing in the list, but then those workgroups might have privleges
which I would not want the users I create to have.

But you are talking about local accounts, I don't think you have tens of
these on a local machine don't you?
If you are running in a Windows domain, you can achieve what you want by
applying Group Policy Management.

Willy.

[abhishek.gilra]

On May 8, 6:29 am, "Willy Denoyette [MVP]"
<[e-mail]:

<[e-mail] in message

news:11********************@n59g2000hsh.googlegrou ps.com...

Oh and I had testusersin mind, so basically - "testuser1" for
example.

Well, actually there is nothing in the Framework that helps you with this.
So you will have to call into some WIn32 LSA API's using PInvoke.
Basically what you need to do is:
1. Get a LSA Policy handle for the target system, by calling LsaOpenPolicy.
2. Get the SID of the user account, by calling LsaLookupNames2
3. Add the "SeInteractiveLogonRight" for the account, by means of a call to
LsaAddAccountRights.
Note that LSA_UNICODE_STRING type as used in these API's is not a CLR
string, it's a structure you need to initialize correctly before you call
the API's, watch out!.

But again, before you can grant this privilege to an account, the account
MUST exist, why not simply create the account and make it a member of the
"users" group or a group which already has the "Allow Logon Locally"
privilege"?

Willy.

I did that and it says -- "specified privilege does not exist" for
"SeInteractiveLogonRight"

[Willy Denoyette [MVP]]

<ab************@gmail.comwrote in message
news:11**********************@n59g2000hsh.googlegr oups.com...

On May 8, 6:29 am, "Willy Denoyette [MVP]"
<[e-mail]:

><[e-mail] in message

news:11********************@n59g2000hsh.googlegro ups.com...

Oh and I had testusersin mind, so basically - "testuser1" for
example.

Well, actually there is nothing in the Framework that helps you with
this.
So you will have to call into some WIn32 LSA API's using PInvoke.
Basically what you need to do is:
1. Get a LSA Policy handle for the target system, by calling
LsaOpenPolicy.
2. Get the SID of the user account, by calling LsaLookupNames2
3. Add the "SeInteractiveLogonRight" for the account, by means of a call
to
LsaAddAccountRights.
Note that LSA_UNICODE_STRING type as used in these API's is not a CLR
string, it's a structure you need to initialize correctly before you call
the API's, watch out!.

But again, before you can grant this privilege to an account, the account
MUST exist, why not simply create the account and make it a member of the
"users" group or a group which already has the "Allow Logon Locally"
privilege"?

Willy.

I did that and it says -- "specified privilege does not exist" for
"SeInteractiveLogonRight"

"SeInteractiveLogonRight" should exist, could you please post some code.

Willy.

[abhishek.gilra]

On May 8, 3:29 pm, [e-mail] wrote:

On May 8, 6:29 am, "Willy Denoyette [MVP]"

<[e-mail]:

<[e-mail] in message

news:11********************@n59g2000hsh.googlegrou ps.com...

Oh and I had testusersin mind, so basically - "testuser1" for
example.

Well, actually there is nothing in the Framework that helps you with this.
So you will have to call into some WIn32 LSA API's using PInvoke.
Basically what you need to do is:
1. Get a LSA Policy handle for the target system, by calling LsaOpenPolicy.
2. Get the SID of the user account, by calling LsaLookupNames2
3. Add the "SeInteractiveLogonRight" for the account, by means of a call to
LsaAddAccountRights.
Note that LSA_UNICODE_STRING type as used in these API's is not a CLR
string, it's a structure you need to initialize correctly before you call
the API's, watch out!.

But again, before you can grant this privilege to an account, the account
MUST exist, why not simply create the account and make it a member of the
"users" group or a group which already has the "Allow Logon Locally"
privilege"?

Willy.

I did that and it says -- "specified privilege does not exist" for
"SeInteractiveLogonRight"- Hide quoted text -

- Show quoted text -

whoops pressed the wrong button. Sorry about that

[abhishek.gilra]

On May 9, 10:06 am, [e-mail] wrote:

On May 8, 3:29 pm, [e-mail] wrote:

On May 8, 6:29 am, "Willy Denoyette [MVP]"

<[e-mail]:

<[e-mail] in message

>news:11********************@n59g2000hsh.googlegro ups.com...

Oh and I had testusersin mind, so basically - "testuser1" for
example.

Well, actually there is nothing in the Framework that helps you with this.
So you will have to call into some WIn32 LSA API's using PInvoke.
Basically what you need to do is:
1. Get a LSA Policy handle for the target system, by calling LsaOpenPolicy.
2. Get the SID of the user account, by calling LsaLookupNames2
3. Add the "SeInteractiveLogonRight" for the account, by means of a call to
LsaAddAccountRights.
Note that LSA_UNICODE_STRING type as used in these API's is not a CLR
string, it's a structure you need to initialize correctly before you call
the API's, watch out!.

But again, before you can grant this privilege to an account, the account
MUST exist, why not simply create the account and make it a member of the
"users" group or a group which already has the "Allow Logon Locally"
privilege"?

Willy.

I did that and it says -- "specified privilege does not exist" for
"SeInteractiveLogonRight"- Hide quoted text -

- Show quoted text -

whoops pressed the wrong button. Sorry about that- Hide quoted text -

- Show quoted text -

Thanks for all the help. Never mind replying to my previous message.
It was a really stupid mistake. Its all working.

Thanks again!