diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 00b49c54f7..ead54a0bfb 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -12,6 +12,61 @@ ms.date: 03/12/2018 # Policy CSP - UserRights +
+ +User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as SIDs or strings. Here is a list for reference, [Well-Known SID Structures](https://msdn.microsoft.com/en-us/library/cc980032.aspx). Even though strings are supported for well-known accounts and groups, it is better to use SIDs because strings are localized for different languages. Some user rights allow things, like AccessFromNetwork, while others disallow things, like DenyAccessFromNetwork. + +Here is an example syncml for setting the user right BackupFilesAndDirectories for Administrators and Authenticated Users groups. + +```syntax + + + + + 2 + + + chr + text/plain + + + ./Device/Vendor/MSFT/Policy/Config/UserRights/BackupFilesAndDirectories + + Authenticated UsersAdministrators + + + + + +``` + +Here are examples of data fields. The encoded 0xF000 is the standard delimiter/separator + +- Grant an user right to Administrators group via SID: + ``` + *S-1-5-32-544 + ``` + +- Grant an user right to multiple groups (Administrators, Authenticated Users) via SID + ``` + *S-1-5-32-544*S-1-5-11 + ``` + +- Grant an user right to multiple groups (Administrators, Authenticated Users) via a mix of SID and Strings + ``` + *S-1-5-32-544Authenticated Users + ``` + +- Grant an user right to multiple groups (Authenticated Users, Administrators) via strings + ``` + Authenticated UsersAdministrators + ``` + +- Empty input indicates that there are no users configured to have that user right + ``` + + ``` +