38

I am trying to view the user privileges using the command prompt in Windows. User account & User privileges such as:

SeBatchLogonRight
SeDenyBatchLogonRight
SeInteractiveLogonRight
SeDenyInteractiveLogonRight
SeServiceLogonRight
SeDenyServiceLogonRight
SeNetworkLogonRight
SeDenyNetworkLogonRight

I tried using ntrights but it's not working. I can't use any tool as I am trying to create an automated script for an OS audit.

2
  • When you say ntrights is "not working", what exactly goes wrong? Jul 24, 2012 at 0:08
  • Assuming it does not necessarily have to be cmd.exe: maybe you can do this wih powershell? if so, maybe ask the question again here, this time with "powershell" tag.
    – knb
    Oct 25, 2012 at 13:09

5 Answers 5

60

You can use the following commands:

whoami /priv
whoami /all

For more information, check whoami @ technet.

3
  • 2
    Note that it's only available out of the box since Vista. In XP, it's in the "Windows XP SP2 Support Tools" download. Aug 3, 2015 at 11:27
  • This is the best answer. IMHO Anyone still using XP needs to upgrade May 25, 2017 at 15:54
  • Note that this will work for privileges but not for rights. Jun 5, 2017 at 22:15
22

Mark Russinovich wrote a terrific tool called AccessChk that lets you get this information from the command line. No installation is necessary.

http://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

For example:

accesschk.exe /accepteula -q -a SeServiceLogonRight

Returns this for me:

IIS APPPOOL\DefaultAppPool
IIS APPPOOL\Classic .NET AppPool
NT SERVICE\ALL SERVICES

By contrast, whoami /priv and whoami /all were missing some entries for me, like SeServiceLogonRight.

2
  • 3
    Tremendous -- not least, allows verification of the right for another user without impersonation with RUNAS. Oct 1, 2014 at 11:47
  • 2
    Yes, whoami /priv will only work for privileges, not rights, because it works by examining the current user token. Rights are only used at logon time, so there's no need for them to be kept in the token. Jun 5, 2017 at 22:13
19

I'd start with:

secedit /export /areas USER_RIGHTS /cfg OUTFILE.CFG

Then examine the line for the relevant privilege. However, the problem now is that the accounts are listed as SIDs, not usernames.

5
  • 19
    Worth a mention... To find out which privs the current user has, use WHOAMI /PRIV. Apr 27, 2013 at 22:07
  • 1
    More details on secedit here.
    – not2qubit
    Mar 4, 2014 at 17:09
  • Would be good if you could explain the details of this command better. I didn't get any sensible output from that on Win8.1.
    – not2qubit
    Mar 4, 2014 at 17:15
  • This is pretty horrible to use but it works well. After exporting the template using Simon's command above, you can import it again using: Secedit /configure /db secedit.sdb /cfg outfile.cfg /quiet /areas USER_RIGHTS
    – NikG
    Mar 20, 2015 at 17:51
  • I'm not sure whether this will work for rights that are acquired indirectly, e.g., via group membership. Jun 5, 2017 at 22:14
3

Go to command prompt and enter the command,

net user <username>

Will show your local group memberships.

If you're on a domain, use localgroup instead:

net localgroup Administrators or net localgroup [Admin group name]

Check the list of local groups with localgroup on its own.

net localgroup
2
  • 6
    I need the detailed privileges of all users as i am logged in as admin... not the basic user info...
    – AJINKYA
    Jul 23, 2012 at 6:47
  • Group membership is a different concept than user privileges. Use whoami /priv May 25, 2017 at 16:01
-5

Use whoami /priv command to list all the user privileges.

1

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.