diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 9359f7ab9e..c6c6ea7779 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1,26 +1,31 @@ --- -title: Policy CSP - UserRights -description: Learn how user rights are assigned for user accounts or groups, and how the name of the policy defines the user right in question. +title: UserRights Policy CSP +description: Learn more about the UserRights Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa -ms.topic: article +ms.date: 12/08/2022 +ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 11/24/2021 -ms.reviewer: -manager: aaroncz +ms.topic: reference --- + + + # Policy CSP - UserRights -
+ + -User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as SIDs or strings. For reference, see [Well-Known SID Structures](/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab). +User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as Security Identifiers (SID) or strings. For more information, see [Well-known SID structures](/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab). Even though strings are supported for well-known accounts and groups, it's better to use SIDs, because strings are localized for different languages. Some user rights allow things like AccessFromNetwork, while others disallow things, like DenyAccessFromNetwork. -Here's an example for setting the user right BackupFilesAndDirectories for Administrators and Authenticated Users groups. +## General example + +Here's an example for setting the user right [BackupFilesAndDirectories](#backupfilesanddirectories) for Administrators and Authenticated Users groups. ```xml @@ -44,1418 +49,1999 @@ Here's an example for setting the user right BackupFilesAndDirectories for Admin ``` -Here are examples of data fields. The encoded 0xF000 is the standard delimiter/separator. +Here are examples of data fields. The encoded `0xF000` is the standard delimiter/separator. - Grant a user right to Administrators group via SID: - ```xml - *S-1-5-32-544 - ``` + + ```xml + *S-1-5-32-544 + ``` - Grant a user right to multiple groups (Administrators, Authenticated Users) via SID: - ```xml - *S-1-5-32-544*S-1-5-11 - ``` + + ```xml + *S-1-5-32-544*S-1-5-11 + ``` - Grant a user right to multiple groups (Administrators, Authenticated Users) via a mix of SID and Strings: - ```xml - *S-1-5-32-544Authenticated Users - ``` + + ```xml + *S-1-5-32-544Authenticated Users + ``` - Grant a user right to multiple groups (Authenticated Users, Administrators) via strings: - ```xml - Authenticated UsersAdministrators - ``` + + ```xml + Authenticated UsersAdministrators + ``` - Empty input indicates that there are no users configured to have that user right: - ```xml - - ``` - If you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag (``) to wrap the data fields. You can specify one or more user groups within the CDATA tag by using 0xF000 as the delimiter/separator. + ```xml + + ``` + +If you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag (``) to wrap the data fields. You can specify one or more user groups within the CDATA tag by using `0xF000` as the delimiter/separator. > [!NOTE] -> `` is the entity encoding of 0xF000. +> `` is the entity encoding of `0xF000`. -For example, the following syntax grants user rights to Authenticated Users and Replicator user groups.: +For example, the following syntax grants user rights to Authenticated Users and Replicator user groups: ```xml ``` -For example, the following syntax grants user rights to two specific Azure Active Directory (AAD) users from Contoso, user1 and user2: +For example, the following syntax grants user rights to two specific Azure Active Directory (Azure AD) users from Contoso, user1 and user2: ```xml ``` -For example, the following syntax grants user rights to a specific user or group, by using the Security Identifier (SID) of the account or group: +For example, the following syntax grants user rights to a specific user or group, by using the SID of the account or group: ```xml ``` -
+ - -## UserRights policies + +## AccessCredentialManagerAsTrustedCaller -
-
- UserRights/AccessCredentialManagerAsTrustedCaller -
-
- UserRights/AccessFromNetwork -
-
- UserRights/ActAsPartOfTheOperatingSystem -
-
- UserRights/AllowLocalLogOn -
-
- UserRights/BackupFilesAndDirectories -
-
- UserRights/ChangeSystemTime -
-
- UserRights/CreateGlobalObjects -
-
- UserRights/CreatePageFile -
-
- UserRights/CreatePermanentSharedObjects -
-
- UserRights/CreateSymbolicLinks -
-
- UserRights/CreateToken -
-
- UserRights/DebugPrograms -
-
- UserRights/DenyAccessFromNetwork -
-
- UserRights/DenyLocalLogOn -
-
- UserRights/DenyRemoteDesktopServicesLogOn -
-
- UserRights/EnableDelegation -
-
- UserRights/GenerateSecurityAudits -
-
- UserRights/ImpersonateClient -
-
- UserRights/IncreaseSchedulingPriority -
-
- UserRights/LoadUnloadDeviceDrivers -
-
- UserRights/LockMemory -
-
- UserRights/ManageAuditingAndSecurityLog -
-
- UserRights/ManageVolume -
-
- UserRights/ModifyFirmwareEnvironment -
-
- UserRights/ModifyObjectLabel -
-
- UserRights/ProfileSingleProcess -
-
- UserRights/RemoteShutdown -
-
- UserRights/RestoreFilesAndDirectories -
-
- UserRights/TakeOwnership -
-
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/AccessCredentialManagerAsTrustedCaller +``` + -
+ + +This user right is used by Credential Manager during Backup/Restore. No accounts should have this privilege, as it is only assigned to Winlogon. Users' saved credentials might be compromised if this privilege is given to other entities. + - -**UserRights/AccessCredentialManagerAsTrustedCaller** + + + - -The table below shows the applicability of Windows: + +**Description framework properties**: -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -
+ +**Group policy mapping**: - -[Scope](./policy-configuration-service-provider.md#policy-scope): +| Name | Value | +|:--|:--| +| Name | Access Credential Manager ase a trusted caller | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -> [!div class = "checklist"] -> * Device + + + -
+ - - -This user right is used by Credential Manager during Backup/Restore. No accounts should have this privilege, as it's only assigned to Winlogon. Users' saved credentials might be compromised if this privilege is given to other entities. + +## AccessFromNetwork - - -GP Info: -- GP Friendly name: *Access Credential Manager as a trusted caller* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + - - + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/AccessFromNetwork +``` + -
+ + +This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right. - -**UserRights/AccessFromNetwork** +**Note**: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. + - -The table below shows the applicability of Windows: + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +**Description framework properties**: - -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +**Group policy mapping**: -> [!div class = "checklist"] -> * Device +| Name | Value | +|:--|:--| +| Name | Access this computer from the network | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -
+ + + - - -This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services isn't affected by this user right. + -> [!NOTE] -> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. + +## ActAsPartOfTheOperatingSystem - - -GP Info: -- GP Friendly name: *Access this computer from the network* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + - - + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ActAsPartOfTheOperatingSystem +``` + -
- - -**UserRights/ActAsPartOfTheOperatingSystem** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - + + This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. > [!CAUTION] -> Assigning this user right can be a security risk. Assign this user right to trusted users only. +> Assigning this user right can be a security risk. Only assign this user right to trusted users. + - - -GP Info: -- GP Friendly name: *Act as part of the operating system* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/AllowLocalLogOn** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Act as part of the operating system | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## AllowLocalLogOn -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/AllowLocalLogOn +``` + - - -This user right determines which users can sign in to the computer. + + +This user right determines which users can log on to the computer. -> [!NOTE] -> Modifying this setting might affect compatibility with clients, services, and applications. For compatibility information about this setting, see [Allow log on locally](https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. +**Note**: Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally ( ) at the Microsoft website. + - - -GP Info: -- GP Friendly name: *Allow log on locally* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/BackupFilesAndDirectories** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Allow log on locally | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## BackupFilesAndDirectories -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/BackupFilesAndDirectories +``` + - - -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system: Traverse Folder/Execute File, Read. + + +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories.Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. > [!CAUTION] -> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, assign this user right to trusted users only. +> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users + - - -GP Info: -- GP Friendly name: *Back up files and directories* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/ChangeSystemTime** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Back up files and directories | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## BypassTraverseChecking -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/BypassTraverseChecking +``` + - - + + +This user right determines which users can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Bypass traverse checking | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + +## ChangeSystemTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ChangeSystemTime +``` + + + + This user right determines which users and groups can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. + + + + > [!CAUTION] -> Configuring user rights replaces existing users or groups previously assigned to those user rights. The system requires that Local Service account (SID S-1-5-19) always has the ChangeSystemTime right. Therefore, Local Service must always be specified in addition to any other accounts being configured in this policy. +> When you configure user rights, it replaces existing users or groups that were previously assigned to those user rights. The system requires that the **Local Service** account (SID `S-1-5-19`) always has the ChangeSystemTime right. Always specify **Local Service**, in addition to any other accounts that you need to configure in this policy. > -> Not including the Local Service account will result in failure with the following error: +> If you don't include the **Local Service** account, the request fails with the following error: > -> | Error code | Symbolic name | Error description | Header | -> |----------|----------|----------|----------| -> | 0x80070032 (Hex)|ERROR_NOT_SUPPORTED|The request isn't supported.| winerror.h | +> | Error code | Symbolic name | Error description | Header | +> |--------------------|---------------------|------------------------------|------------| +> | `0x80070032` (Hex) | ERROR_NOT_SUPPORTED | The request isn't supported. | winerror.h | - - -GP Info: -- GP Friendly name: *Change the system time* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/CreateGlobalObjects** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Change the system time | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## ChangeTimeZone -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ChangeTimeZone +``` + - - -This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they don't have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. + + +This user right determines which users and groups can change the time zone used by the computer for displaying the local time, which is the computer's system time plus the time zone offset. System time itself is absolute and is not affected by a change in the time zone. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Change the time zone | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + +## CreateGlobalObjects + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/CreateGlobalObjects +``` + + + + +This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. > [!CAUTION] -> Assigning this user right can be a security risk. Assign this user right to trusted users only. +> Assigning this user right can be a security risk. Assign this user right only to trusted users. + - - -GP Info: -- GP Friendly name: *Create global objects* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/CreatePageFile** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Create global objects | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## CreatePageFile -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/CreatePageFile +``` + - - -This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually doesn't need to be assigned to any users. + + +This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users + - - -GP Info: -- GP Friendly name: *Create a pagefile* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/CreatePermanentSharedObjects** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Create a pagefile | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## CreatePermanentSharedObjects -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/CreatePermanentSharedObjects +``` + - - -This user right determines which accounts can be used by processes to create a directory object using the object manager. This user right is used internally by the operating system and is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel mode already have this user right assigned to them, it's not necessary to specifically assign it. + + +This user right determines which accounts can be used by processes to create a directory object using the object manager. This user right is used internally by the operating system and is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel mode already have this user right assigned to them, it is not necessary to specifically assign it. + - - -GP Info: -- GP Friendly name: *Create permanent shared objects* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/CreateSymbolicLinks** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Create permanent shared objects | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## CreateSymbolicLinks -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/CreateSymbolicLinks +``` + - - -This user right determines if the user can create a symbolic link from the computer they're signed in to. + + +This user right determines if the user can create a symbolic link from the computer he is logged on to. > [!CAUTION] -> This privilege should be given to trusted users only. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. +> This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. -> [!NOTE] -> This setting can be used in conjunction with a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. +**Note**: This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. + - - -GP Info: -- GP Friendly name: *Create symbolic links* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/CreateToken** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Create symbolic links | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## CreateToken -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/CreateToken +``` + - - -This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it's necessary, don't assign this user right to a user, group, or process other than Local System. + + +This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. > [!CAUTION] -> Assigning this user right can be a security risk. Don't assign this user right to any user, group, or process that you don't want to take over the system. +> Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. + - - -GP Info: -- GP Friendly name: *Create a token object* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/DebugPrograms** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Create a token object | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## DebugPrograms -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/DebugPrograms +``` + - - -This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications don't need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. + + +This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. > [!CAUTION] -> Assigning this user right can be a security risk. Assign this user right to trusted users only. +> Assigning this user right can be a security risk. Only assign this user right to trusted users. + - - -GP Info: -- GP Friendly name: *Debug programs* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/DenyAccessFromNetwork** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Debug programs | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## DenyAccessFromNetwork -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/DenyAccessFromNetwork +``` + - - -This user right determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access to this computer from the network policy setting if a user account is subject to both policies. + + +This user right determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies. + - - -GP Info: -- GP Friendly name: *Deny access to this computer from the network* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/DenyLocalLogOn** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Deny access to this computer from the network | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## DenyLocalLogOn -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/DenyLocalLogOn +``` + - - -This security setting determines which users are prevented from logging on to the computer. This policy setting supersedes the **Allow log on locally** policy setting if an account is subject to both policies. + + +This security setting determines which service accounts are prevented from registering a process as a service. -> [!NOTE] -> If you apply this security policy to the **Everyone** group, no one will be able to log on locally. +**Note**: This security setting does not apply to the System, Local Service, or Network Service accounts. + - - -GP Info: -- GP Friendly name: *Deny log on Locally* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + - - + -
+ - -**UserRights/DenyRemoteDesktopServicesLogOn** + +**Description framework properties**: - -The table below shows the applicability of Windows: +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +**Group policy mapping**: - -
+| Name | Value | +|:--|:--| +| Name | Deny log on as a service | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + -
+ +## DenyLogOnAsBatchJob - - -This user right determines which users and groups are prohibited from logging on as Remote Desktop Services clients. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + - - -GP Info: -- GP Friendly name: *Deny log on through Remote Desktop Services* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/DenyLogOnAsBatchJob +``` + - - + + +This security setting determines which accounts are prevented from being able to log on as a batch job. This policy setting supersedes the Log on as a batch job policy setting if a user account is subject to both policies. + -
+ + + - -**UserRights/EnableDelegation** + +**Description framework properties**: - -The table below shows the applicability of Windows: +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +**Group policy mapping**: - -
+| Name | Value | +|:--|:--| +| Name | Deny log on as a batch job | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + -
+ +## DenyRemoteDesktopServicesLogOn - - -This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account doesn't have the Account can't be delegated account control flag set. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/DenyRemoteDesktopServicesLogOn +``` + + + + +This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Deny log on through Remote Desktop Services | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + +## EnableDelegation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/EnableDelegation +``` + + + + +This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. > [!CAUTION] > Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. + - - -GP Info: -- GP Friendly name: *Enable computer and user accounts to be trusted for delegation* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/GenerateSecurityAudits** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Enable computer and user accounts to be trusted for delegation | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## GenerateSecurityAudits -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/GenerateSecurityAudits +``` + - - + + This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access. Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial of service. Shut down system immediately if unable to log security audits security policy setting is enabled. + - - -GP Info: -- GP Friendly name: *Generate security audits* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/ImpersonateClient** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Generate security audits | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## ImpersonateClient -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ImpersonateClient +``` + - - + + Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. > [!CAUTION] -> Assigning this user right can be a security risk. Assign this user right to trusted users only. +> Assigning this user right can be a security risk. Only assign this user right to trusted users. -> [!NOTE] -> By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. +**Note**: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. Because of these factors, users do not usually need this user right. -1. The access token that is being impersonated is for this user. -1. The user, in this sign-in session, created the access token by signing in to the network with explicit credentials. -1. The requested level is less than Impersonate, such as Anonymous or Identify. +**Warning**: If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. + -Because of these factors, users don't usually need this user right. + + + -> [!WARNING] -> If you enable this setting, programs that previously had the Impersonate privilege might lose it, and they might not run. + +**Description framework properties**: - - -GP Info: -- GP Friendly name: *Impersonate a client after authentication* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - - + +**Group policy mapping**: -
+| Name | Value | +|:--|:--| +| Name | Impersonate a client after authentication | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + - -**UserRights/IncreaseSchedulingPriority** + + + - -The table below shows the applicability of Windows: + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +## IncreaseProcessWorkingSet - -
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/IncreaseProcessWorkingSet +``` + -> [!div class = "checklist"] -> * Device + + +Increase a process working set. This privilege determines which user accounts can increase or decrease the size of a process’s working set. The working set of a process is the set of memory pages currently visible to the process in physical RAM memory. These pages are resident and available for an application to use without triggering a page fault. The minimum and maximum working set sizes affect the virtual memory paging behavior of a process. -
+**Warning**: Increasing the working set size for a process decreases the amount of physical memory available to the rest of the system. + - - + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Increase a process working set | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + +## IncreaseSchedulingPriority + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/IncreaseSchedulingPriority +``` + + + + This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. + - - -GP Info: -- GP Friendly name: *Increase scheduling priority* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + > [!WARNING] -> If you remove **Window Manager\Window Manager Group** from the **Increase scheduling priority** user right, certain applications and computers don't function correctly. In particular, the INK workspace doesn't function correctly on unified memory architecture (UMA) laptop and desktop computers that run Windows 10, version 1903 (or later) and that use the Intel GFX driver. +> If you remove **Window Manager\Window Manager Group** from the **Increase scheduling priority** user right, certain applications and computers won't function correctly. In particular, the INK workspace doesn't function correctly on unified memory architecture (UMA) laptop and desktop computers that run Windows 10, version 1903 or later and that use the Intel GFX driver. > > On affected computers, the display blinks when users draw on INK workspaces such as those that are used by Microsoft Edge, Microsoft PowerPoint, or Microsoft OneNote. The blinking occurs because the inking-related processes repeatedly try to use the Real-Time priority, but are denied permission. - - + -
+ +**Description framework properties**: - -**UserRights/LoadUnloadDeviceDrivers** +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -The table below shows the applicability of Windows: + +**Group policy mapping**: -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +| Name | Value | +|:--|:--| +| Name | Increase scheduling priority | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + - -
+ + + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + -> [!div class = "checklist"] -> * Device + +## LoadUnloadDeviceDrivers -
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + - - -This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right doesn't apply to Plug and Play device drivers. It's recommended that you don't assign this privilege to other users. + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/LoadUnloadDeviceDrivers +``` + + + + +This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. > [!CAUTION] -> Assigning this user right can be a security risk. Don't assign this user right to any user, group, or process that you don't want to take over the system. +> Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. + - - -GP Info: -- GP Friendly name: *Load and unload device drivers* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/LockMemory** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Load and unload device drivers | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## LockMemory -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/LockMemory +``` + - - -This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege might significantly affect system performance by decreasing the amount of available random access memory (RAM). + + +This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). + - - -GP Info: -- GP Friendly name: *Lock pages in memory* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/ManageAuditingAndSecurityLog** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Lock pages in memory | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## LogOnAsBatchJob -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/LogOnAsBatchJob +``` + - - -This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting doesn't allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege also can view and clear the security log. + + +This security setting allows a user to be logged on by means of a batch-queue facility and is provided only for compatibility with older versions of Windows. For example, when a user submits a job by means of the task scheduler, the task scheduler logs that user on as a batch user rather than as an interactive user. + - - -GP Info: -- GP Friendly name: *Manage auditing and security log* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/ManageVolume** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Log on as a batch job | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## LogOnAsService -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/LogOnAsService +``` + - - -This user right determines which users and groups can run maintenance tasks on a volume, such as remote de-fragmentation. Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data. + + +This security setting allows a security principal to log on as a service. Services can be configured to run under the Local System, Local Service, or Network Service accounts, which have a built in right to log on as a service. Any service that runs under a separate user account must be assigned the right. + - - -GP Info: -- GP Friendly name: *Perform volume maintenance tasks* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/ModifyFirmwareEnvironment** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Log on as a service | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## ManageAuditingAndSecurityLog -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ManageAuditingAndSecurityLog +``` + - - -This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should be modified only by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows. + + +This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log. + -> [!NOTE] -> This security setting doesn't affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. + + + - - -GP Info: -- GP Friendly name: *Modify firmware environment values* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + +**Description framework properties**: - - +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + -
+ +**Group policy mapping**: - -**UserRights/ModifyObjectLabel** +| Name | Value | +|:--|:--| +| Name | Manage auditing and security log | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + - -The table below shows the applicability of Windows: + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ +## ManageVolume - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -> [!div class = "checklist"] -> * Device + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ManageVolume +``` + -
+ + +This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data. + - - + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Perform volume maintenance tasks | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + +## ModifyFirmwareEnvironment + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ModifyFirmwareEnvironment +``` + + + + +This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows. + +**Note**: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Modify firmware environment values | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + +## ModifyObjectLabel + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ModifyObjectLabel +``` + + + + This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. + - - -GP Info: -- GP Friendly name: *Modify an object label* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/ProfileSingleProcess** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Modify an object label | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## ProfileSingleProcess -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ProfileSingleProcess +``` + - - + + This user right determines which users can use performance monitoring tools to monitor the performance of system processes. + - - -GP Info: -- GP Friendly name: *Profile single process* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/RemoteShutdown** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Profile single process | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## ProfileSystemPerformance -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ProfileSystemPerformance +``` + - - + + +This security setting determines which users can use performance monitoring tools to monitor the performance of system processes. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Profile system performance | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + +## RemoteShutdown + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/RemoteShutdown +``` + + + + This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service. + - - -GP Info: -- GP Friendly name: *Force shutdown from a remote system* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/RestoreFilesAndDirectories** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Force shutdown from a remote system | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## ReplaceProcessLevelToken -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ReplaceProcessLevelToken +``` + - - -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and it determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system: Traverse Folder/Execute File, Write. + + +This security setting determines which user accounts can call the CreateProcessAsUser() application programming interface (API) so that one service can start another. An example of a process that uses this user right is Task Scheduler. For information about Task Scheduler, see Task Scheduler overview. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Replace a process level token | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + +## RestoreFilesAndDirectories + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/RestoreFilesAndDirectories +``` + + + + +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. > [!CAUTION] -> Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, assign this user right to trusted users only. +> Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. + - - -GP Info: -- GP Friendly name: *Restore files and directories* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - + +**Description framework properties**: -
+| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + - -**UserRights/TakeOwnership** + +**Group policy mapping**: - -The table below shows the applicability of Windows: +| Name | Value | +|:--|:--| +| Name | Restore files and directories | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## ShutDownTheSystem -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/ShutDownTheSystem +``` + - - + + +This security setting determines which users who are logged on locally to the computer can shut down the operating system using the Shut Down command. Misuse of this user right can result in a denial of service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Shut down the system | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + +## TakeOwnership + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/UserRights/TakeOwnership +``` + + + + This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. > [!CAUTION] -> Assigning this user right can be a security risk. Since owners of objects have full control of them, assign this user right to trusted users only. +> Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. + - - -GP Info: -- GP Friendly name: *Take ownership of files or other objects* -- GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* + + + - - -
+ +**Description framework properties**: - +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `0xF000`) | + -## Related topics + +**Group policy mapping**: -[Policy configuration service provider](policy-configuration-service-provider.md) \ No newline at end of file +| Name | Value | +|:--|:--| +| Name | Take ownership of files or other objects | +| Path | Windows Settings > Security Settings > Local Policies > User Rights Assignment | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md)