How to view user privileges using windows cmd?

Question

I am trying to view the user privileges using the command prompt in Windows. User account & User privileges such as:

SeBatchLogonRight
SeDenyBatchLogonRight
SeInteractiveLogonRight
SeDenyInteractiveLogonRight
SeServiceLogonRight
SeDenyServiceLogonRight
SeNetworkLogonRight
SeDenyNetworkLogonRight

I tried using ntrights but it's not working. I can't use any tool as I am trying to create an automated script for an OS audit.

When you say ntrights is "not working", what exactly goes wrong? — Harry Johnston, Jul 24 '12 at 00:08
Assuming it does not necessarily have to be cmd.exe: maybe you can do this wih powershell? if so, maybe ask the question again here, this time with "powershell" tag. — knb, Oct 25 '12 at 13:09

score 60 · Answer 1 · edited Dec 03 '19 at 03:28

60

You can use the following commands:

whoami /priv
whoami /all

For more information, check whoami @ technet.

edited Dec 03 '19 at 03:28

galoget

722
9
15

answered Aug 23 '13 at 08:47

rfb

1,107
1
7
14

2

Note that it's only available out of the box since Vista. In XP, it's in the "Windows XP SP2 Support Tools" download. – ivan_pozdeev Aug 03 '15 at 11:27
This is the best answer. IMHO Anyone still using XP needs to upgrade – Burt_Harris May 25 '17 at 15:54
Note that this will work for privileges but not for rights. – Harry Johnston Jun 05 '17 at 22:15

twasbrillig · Answer 2 · 2014-01-07T07:14:37.037

22

Mark Russinovich wrote a terrific tool called AccessChk that lets you get this information from the command line. No installation is necessary.

http://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

For example:

accesschk.exe /accepteula -q -a SeServiceLogonRight

Returns this for me:

IIS APPPOOL\DefaultAppPool
IIS APPPOOL\Classic .NET AppPool
NT SERVICE\ALL SERVICES

By contrast, whoami /priv and whoami /all were missing some entries for me, like SeServiceLogonRight.

edited Jan 07 '14 at 07:14

answered Jan 07 '14 at 07:02

twasbrillig

17,084
9
43
67

3

Tremendous -- not least, allows verification of the right for another user without impersonation with RUNAS. – Jeremy McGee Oct 01 '14 at 11:47
2

Yes, `whoami /priv` will only work for privileges, not rights, because it works by examining the current user token. Rights are only used at logon time, so there's no need for them to be kept in the token. – Harry Johnston Jun 05 '17 at 22:13

score 19 · Accepted Answer · edited Dec 02 '19 at 23:05

19

I'd start with:

secedit /export /areas USER_RIGHTS /cfg OUTFILE.CFG

Then examine the line for the relevant privilege. However, the problem now is that the accounts are listed as SIDs, not usernames.

edited Dec 02 '19 at 23:05

galoget

722
9
15

answered Jul 27 '12 at 22:48

Simon Catlin

2,141
1
13
15

19

Worth a mention... To find out which privs the current user has, use WHOAMI /PRIV. – Simon Catlin Apr 27 '13 at 22:07
1

More details on secedit [here](http://technet.microsoft.com/en-us/library/bb490997.aspx). – not2qubit Mar 04 '14 at 17:09
Would be good if you could explain the details of this command better. I didn't get any sensible output from that on Win8.1. – not2qubit Mar 04 '14 at 17:15
This is pretty horrible to use but it works well. After exporting the template using Simon's command above, you can import it again using: Secedit /configure /db secedit.sdb /cfg outfile.cfg /quiet /areas USER_RIGHTS – NikG Mar 20 '15 at 17:51
I'm not sure whether this will work for rights that are acquired indirectly, e.g., via group membership. – Harry Johnston Jun 05 '17 at 22:14

score 3 · Answer 4 · answered Jul 23 '12 at 06:40

3

Go to command prompt and enter the command,

net user <username>

Will show your local group memberships.

If you're on a domain, use localgroup instead:

net localgroup Administrators or net localgroup [Admin group name]

Check the list of local groups with localgroup on its own.

net localgroup

answered Jul 23 '12 at 06:40

6

I need the detailed privileges of all users as i am logged in as admin... not the basic user info... – AJINKYA Jul 23 '12 at 06:47
Group membership is a different concept than user privileges. Use `whoami /priv` – Burt_Harris May 25 '17 at 16:01

score -5 · Answer 5 · answered Jun 05 '17 at 12:59

-5

Use whoami /priv command to list all the user privileges.

answered Jun 05 '17 at 12:59

Nimisha

39
1
5

6

You should not duplicate existing answers, especially that there already is [a more complete answer](https://stackoverflow.com/a/18398600/868014). – Roman R. Jun 05 '17 at 13:23

How to view user privileges using windows cmd?

5 Answers5

Linked