Microsoft KB Archive/163905

= Auditing User Right Assignment Changes =

Article ID: 163905

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows NT Workstation 3.5
 * Microsoft Windows NT Workstation 3.51
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Server 3.51
 * Microsoft Windows NT Server 4.0 Standard Edition

-



This article was previously published under Q163905



SUMMARY
Windows NT can audit when a user or group is added to or removed from a User Right. To audit these types of action, choose the auditing category, Security Policy Changes in User Manager under the Policies menu, auditing. This is the only needed audit category to audit these specific actions. Only the audit category File and Object Access will add additional security events, but these events simply show objects being opened and handles being closed for user account access that populate the Add Users and Groups dialog boxes.



MORE INFORMATION
Below is the sample output from the Security Event Log when a user is added to each of the User Right. Although User Manager does not differentiate between User Privileges and Rights, in actuality only Privileges are currently audited. Actions that are not audited are actually "rights."

 Access this computer from the network: no events  Act as part of the operating system: (Advanced Right)

2/17/97 2:29:19 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeTcbPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC)   Add workstations to domain:

2/17/97 2:18:11 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeMachineAccountPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC)   Back up files and directories:

2/17/97 2:19:03 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeBackupPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC)   Bypass traverse checking: (Advanced Right)

<pre class="fixed_text">2/17/97 2:30:06 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeChangeNotifyPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Change the system time:

<pre class="fixed_text">2/17/97 2:19:57 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeSystemtimePrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Create a pagefile: (Advanced Right)

<pre class="fixed_text">2/17/97 2:30:57 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeCreatePagefilePrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Create a token object: (Advanced Right)

<pre class="fixed_text">2/17/97 2:31:45 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeCreateTokenPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Create permanent shared objects: (Advanced Right)

<pre class="fixed_text">2/17/97 2:32:40 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeCreatePermanentPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Debug programs: (Advanced Right)

<pre class="fixed_text">2/17/97 2:33:41 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeDebugPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Force shutdown from a remote system:

<pre class="fixed_text">2/17/97 2:20:46 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeRemoteShutdownPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Generate security audits: (Advanced Right)

<pre class="fixed_text">2/17/97 2:34:31 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeAuditPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Increase quotas: (Advanced Right)

<pre class="fixed_text">2/17/97 2:35:12 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeIncreaseQuotaPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Increase scheduling priority: (Advanced Right)

<pre class="fixed_text">2/17/97 2:35:52 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeIncreaseBasePriorityPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Load and unload device drivers:

<pre class="fixed_text">2/17/97 2:21:43 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeLoadDriverPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Lock pages in memory: (Advanced Right)

<pre class="fixed_text">2/17/97 2:36:57 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeLockMemoryPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li> Log on as a batch job: (Advanced Right) no events</li> Log on as a service: (Advanced Right) no events</li> Log on locally: no events</li>  Manage auditing and security log:

<pre class="fixed_text">2/17/97 2:25:18 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeSecurityPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li>  Modify firmware environment values: (Advanced Right)

<pre class="fixed_text">2/17/97 2:41:54 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeSystemEnvironmentPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li> <li> Profile single process: (Advanced Right)

<pre class="fixed_text">2/17/97 3:20:18 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeProfileSingleProcessPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li> <li> Profile system performance: (Advanced Right)

<pre class="fixed_text">2/17/97 3:21:11 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeSystemProfilePrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li> <li> Replace a process level token: (Advanced Right)

<pre class="fixed_text">2/17/97 3:21:57 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeAssignPrimaryTokenPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li> <li> Restore files and directories:

<pre class="fixed_text">2/17/97 2:26:13 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeRestorePrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li> <li> Shut down the system:

<pre class="fixed_text">2/17/97 2:27:00 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeShutdownPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li> <li> Take ownership of files or other objects:

<pre class="fixed_text">2/17/97 2:27:41 PM  Security Success Audit  Policy Change  608 randymc RANDYMC1 User Right Assigned: User Right: SeTakeOwnershipPrivilege Assigned To:  S-1-5-21-2092848103-1120294241-1737835142-7944 Assigned By: User Name: randymc Domain:    RANDYMCD Logon ID:  (0x0,0x1EDC) </li></ol>

Keywords: kbenv kbinfo KB163905

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.