User Rights Assignment¶
A user right is a system-wide privilege: who can log on over the network, who can load drivers, who can take ownership of any file. They're separate from group membership and from file permissions, and an image can grant a dangerous one to Everyone or to Users.
Where¶
secpol.msc → Local Policies → User Rights Assignment. Each row is a right; double-click to see who holds it.
The rule¶
Administrators hold the dangerous ones. Service accounts (LOCAL SERVICE, NETWORK SERVICE, SERVICE) hold only what Windows needs them to. Everyone and Users hold almost nothing. Several rights should be empty ("No One").
The full list¶
Every right the benchmark specifies. The Should be column is the complete membership; anything else in the list comes out.
| CIS | Right | Should be | Why it matters |
|---|---|---|---|
| 2.2.1 | Access Credential Manager as a trusted caller | No One | Read saved credentials out of Credential Manager |
| 2.2.2 | Access this computer from the network | Administrators, Remote Desktop Users | Who can connect to shares and remote services. Remove Everyone and Users. |
| 2.2.3 | Act as part of the operating system | No One | Impersonate any user without authenticating |
| 2.2.4 | Adjust memory quotas for a process | Administrators, LOCAL SERVICE, NETWORK SERVICE | Starve other processes of memory |
| 2.2.5 | Allow log on locally | Administrators, Users | Who can sit at the console. Remove Guests. |
| 2.2.6 | Allow log on through Remote Desktop Services | Administrators, Remote Desktop Users | |
| 2.2.7 | Back up files and directories | Administrators | Read any file regardless of permissions |
| 2.2.8 | Change the system time | Administrators, LOCAL SERVICE | Break log timestamps and Kerberos. Remove Users. |
| 2.2.9 | Create a pagefile | Administrators | The pagefile can contain memory contents |
| 2.2.10 | Create a token object | No One | Forge access tokens for any user |
| 2.2.11 | Create global objects | Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE | Objects visible across all sessions |
| 2.2.12 | Create permanent shared objects | No One | Kernel objects that outlive the process |
| 2.2.13 | Create symbolic links | Administrators (plus NT VIRTUAL MACHINE\Virtual Machines if Hyper-V is installed) |
Symlink attacks redirect file writes |
| 2.2.14 | Debug programs | Administrators | Attach to any process, including the one holding passwords in memory |
| 2.2.15 | Deny access to this computer from the network | Guests, Local account | Deny overrides allow; keeps Guest and unmanaged local accounts off the network |
| 2.2.16 | Deny log on as a batch job | Guests | |
| 2.2.17 | Deny log on as a service | Guests | |
| 2.2.18 | Deny log on locally | Guests | |
| 2.2.19 | Deny log on through Remote Desktop Services | Guests, Local account | |
| 2.2.20 | Enable computer and user accounts to be trusted for delegation | No One | Impersonate users across the domain. Remove Everyone. |
| 2.2.21 | Force shutdown from a remote system | Administrators | |
| 2.2.22 | Generate security audits | LOCAL SERVICE, NETWORK SERVICE, RESTRICTED SERVICES\PrintSpoolerService |
Write to the Security log; a process holding this can flood it |
| 2.2.23 | Impersonate a client after authentication | Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE, RESTRICTED SERVICES\PrintSpoolerService |
Act as a connected client |
| 2.2.24 | Increase scheduling priority | Administrators, Window Manager\Window Manager Group |
Starve other processes of CPU |
| 2.2.25 | Load and unload device drivers | Administrators | Drivers run in the kernel |
| 2.2.26 | Lock pages in memory | No One | Keep data out of the pagefile, exhaust RAM |
| 2.2.27 | Log on as a batch job | Administrators | Level 2. Scheduled tasks use batch logon. |
| 2.2.28 | Log on as a service | No One | Level 2. Services should run as built-in or virtual accounts. Hyper-V adds NT VIRTUAL MACHINE\Virtual Machines; Application Guard adds WDAGUtilityAccount. |
| 2.2.29 | Manage auditing and security log | Administrators | Clear the Security log |
| 2.2.30 | Modify an object label | No One | Change integrity levels |
| 2.2.31 | Modify firmware environment values | Administrators | Change UEFI variables, including Secure Boot state |
| 2.2.32 | Perform volume maintenance tasks | Administrators | Raw disk access, which bypasses file permissions |
| 2.2.33 | Profile single process | Administrators | Read another process's performance data |
| 2.2.34 | Profile system performance | Administrators, NT SERVICE\WdiServiceHost |
|
| 2.2.35 | Replace a process level token | LOCAL SERVICE, NETWORK SERVICE | Start a process with another user's token |
| 2.2.36 | Restore files and directories | Administrators | Write any file regardless of permissions, and set ownership |
| 2.2.37 | Shut down the system | Administrators, Users | |
| 2.2.38 | Take ownership of files or other objects | Administrators | Bypass every file permission |
Domain-joined workstations¶
On a machine in a domain, the STIG adds the domain's most powerful groups to the deny rights so that a Domain Admin's credentials never sit in a workstation's memory where they could be stolen:
| Right | Add |
|---|---|
| Deny access to this computer from the network | Enterprise Admins, Domain Admins, Local account (plus Guests) |
| Deny log on as a batch job | Enterprise Admins, Domain Admins (plus Guests) |
| Deny log on as a service | Enterprise Admins, Domain Admins |
| Deny log on locally | Enterprise Admins, Domain Admins (plus Guests) |
| Deny log on through Remote Desktop Services | Enterprise Admins, Domain Admins, Local account (plus Guests) |
Orphaned SIDs¶
When an account is deleted but a right still references it, the right shows a bare SID (S-1-5-21-...) with no name. The STIG requires removing them: they clutter the policy, and if an account is ever created with the same SID it inherits the right. Any unresolved SID in a right is a finding; select it and Remove.
Changing one¶
Double-click the right → select the entry to remove → Remove → OK. To add: Add User or Group → type the name → Check Names.
Names like NT SERVICE\WdiServiceHost and Window Manager\Window Manager Group are typed exactly; Check Names resolves them.
Verify¶
secedit /export /cfg C:\secpol.txt, then read the [Privilege Rights] section. Rights are listed by internal name with SIDs:
SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-32-555
SeTcbPrivilege =
SeDebugPrivilege = *S-1-5-32-544
SeTakeOwnershipPrivilege = *S-1-5-32-544
SeDenyNetworkLogonRight = *S-1-5-32-546,*S-1-5-114
An empty right after = is No One.
| SID | Is |
|---|---|
S-1-1-0 |
Everyone |
S-1-5-11 |
Authenticated Users |
S-1-5-32-544 |
Administrators |
S-1-5-32-545 |
Users |
S-1-5-32-546 |
Guests |
S-1-5-32-555 |
Remote Desktop Users |
S-1-5-19 |
LOCAL SERVICE |
S-1-5-20 |
NETWORK SERVICE |
S-1-5-6 |
SERVICE |
S-1-5-114 |
Local account |
Any line containing *S-1-1-0 (Everyone) deserves a look. SeSystemtimePrivilege containing *S-1-5-32-545 means Users can change the clock.
Example¶
The export shows:
SeTakeOwnershipPrivilege = *S-1-5-32-544,*S-1-5-32-545
SeNetworkLogonRight = *S-1-1-0,*S-1-5-32-544
SeDebugPrivilege = *S-1-5-32-544,*S-1-5-21-...-1004
Users can take ownership of any file, Everyone can access the machine over the network, and a specific user (the -1004 SID) can debug any process, which means reading passwords out of memory. Open each right and remove the extra entries.