Ntrights — Updated

The "RightName" parameter is case-sensitive and must match Windows internal constants. Common examples include: : Log on as a service. SeNetworkLogonRight : Access this computer from the network. SeBatchLogonRight : Log on as a batch job. SeSystemtimePrivilege : Change the system time. Modern Alternatives

: Used to grant ( +r ) or revoke ( -r ) a specific right. ntrights

In legacy Windows environments (NT 4.0, 2000, XP, Server 2003), assigning or revoking specific privileges for a user or group often required manual registry edits or third-party tools. The ntrights.exe utility provided a command-line interface to modify the Local Security Policy (LSA policy) by directly manipulating the Se* privileges stored in the security database. The "RightName" parameter is case-sensitive and must match

: An optional switch to apply changes to a remote machine. Common Use Cases SeBatchLogonRight : Log on as a batch job

The primary purpose of NTRights is to modify the Local Security Policy without using the graphical User Rights Assignment interface. This makes it ideal for batch files or deployment scripts.

Instead of opening secpol.msc , navigating to Local Policies -> User Rights Assignment, finding the policy, adding the user, and closing the console, you run this:

You need to grant a colleague shutdown privileges on a server named APP-SRV-01 but you don't want to RDP into it.