Partager via


User Rights Assignment

 

Applies To: Windows Vista, Windows Server 2008, Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2012, Windows 8

This reference topic for the IT professional provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in the Windows operating system.

User rights govern the methods by which a user can log on to a system. User rights are applied at the local computer level, and they allow users to perform tasks on a computer or in a domain. User rights include logon rights and permissions. Logon rights control who is authorized to log on to a computer and how they can log on. User rights permissions control access to computer and domain resources, and they can override permissions that have been set on specific objects. User rights are managed in Group Policy under the User Rights Assignment item.

Each user right has a constant name and a Group Policy name associated with it. The constant names are used when referring to the user right in log events. You can configure the user rights assignment settings in the following location within the Group Policy Management Console (GPMC) under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment, or on the local computer by using the Local Group Policy Editor (gpedit.msc).

For information about setting security policies, see How to Configure Security Policy Settings.

The following table links to each security policy setting and provides the constant name for each. Setting descriptions contain reference information, best practices for configuring the policy setting, default values, differences between operating system versions, and considerations for policy management and security.

Group Policy Setting

Constant Name

Access Credential Manager as a trusted caller

SeTrustedCredManAccessPrivilege

Access this computer from the network

SeNetworkLogonRight

Act as part of the operating system

SeTcbPrivilege

Add workstations to domain

SeMachineAccountPrivilege

Adjust memory quotas for a process

SeIncreaseQuotaPrivilege

Allow log on locally

SeInteractiveLogonRight

Allow log on through Remote Desktop Services

SeRemoteInteractiveLogonRight

Back up files and directories

SeBackupPrivilege

Bypass traverse checking

SeChangeNotifyPrivilege

Change the system time

SeSystemtimePrivilege

Change the time zone

SeTimeZonePrivilege

Create a pagefile

SeCreatePagefilePrivilege

Create a token object

SeCreateTokenPrivilege

Create global objects

SeCreateGlobalPrivilege

Create permanent shared objects

SeCreatePermanentPrivilege

Create symbolic links

SeCreateSymbolicLinkPrivilege

Debug programs

SeDebugPrivilege

Deny access to this computer from the network

SeDenyNetworkLogonRight

Deny log on as a batch job

SeDenyBatchLogonRight

Deny log on as a service

SeDenyServiceLogonRight

Deny log on locally

SeDenyInteractiveLogonRight

Deny log on through Remote Desktop Services

SeDenyRemoteInteractiveLogonRight

Enable computer and user accounts to be trusted for delegation

SeEnableDelegationPrivilege

Force shutdown from a remote system

SeRemoteShutdownPrivilege

Generate security audits

SeAuditPrivilege

Impersonate a client after authentication

SeImpersonatePrivilege

Increase a process working set

SeIncreaseWorkingSetPrivilege

Increase scheduling priority

SeIncreaseBasePriorityPrivilege

Load and unload device drivers

SeLoadDriverPrivilege

Lock pages in memory

SeLockMemoryPrivilege

Log on as a batch job

SeBatchLogonRight

Log on as a service

SeServiceLogonRight

Manage auditing and security log

SeSecurityPrivilege

Modify an object label

SeRelabelPrivilege

Modify firmware environment values

SeSystemEnvironmentPrivilege

Perform volume maintenance tasks

SeManageVolumePrivilege

Profile single process

SeProfileSingleProcessPrivilege

Profile system performance

SeSystemProfilePrivilege

Remove computer from docking station

SeUndockPrivilege

Replace a process level token

SeAssignPrimaryTokenPrivilege

Restore files and directories

SeRestorePrivilege

Shut down the system

SeShutdownPrivilege

Synchronize directory service data

SeSyncAgentPrivilege

Take ownership of files or other objects

SeTakeOwnershipPrivilege