Sunday, 24 November 2013

Set Logon As A Service right to User by Powershell, C#, CMD and VBScript


In this article, I am going to explain about how to set or grant user Logon As A Service permission/privilege using Local Security Policy, VBScript, Powershell, C# and Command Line tool.


Set Logon As A Service right to user using Local Security Policy

Follow the below steps to set Log on As Service right via Local Security Policy

1. Open the Run window by pressing 'Windows' + 'R'  keys.
2. Type the command secpol.msc in the text box and click OK.

Set Logon As A Service right to User by Command Prompt, C#, Powershell and VBScript
3. Now the Local Security Policy window will be open, in that window navigate to the node User Rights Assignment (Security Settings -> Local Polices ->User Rights Assignment). In right side pane, search and select the policy Log on as a service.

Set Logon As A Service rights to User by Command Line, C#, Powershell and VBScript

4. Double-click on the policy Log on as a service, in the opened windows click the button Add User or Group, select the user which you want to set logon as a service right and click OK, and click Apply button to finish.

Set Log on As A Service right to User by Powershell, Command Prompt, C# and VBScript

Set or Grant User Logon As A Service right via Powershell

 We can set the Logon As A Service right to user in Powershell by importing the third party DLL ( Carbon ).  Before you run the below script you need to the download latest Carbon files from here Download Carbon DLL.

Steps to follow to set Logon As A Service right via Powershell :

  1. Download latest Carbon files from here Download Carbon DLL.
  2. If you have downloaded the files, extract the zip file and you could see the Carbon DLL inside bin folder (In my case: C:\Users\Administrator\Downloads\Carbon\bin\Carbon.dll).
  3. Copy the below Powershell script commands and place it notepad or textfile.
  4. Now you can replace your Carbon DLL path in following script for the variable $CarbonDllPath
  5. You can also replace the user identity that you are going to set logon as service right in the variable $Identity
  6. Now run as Powershell window with Admin Privilege (Run as Administrator)
  7. Copy the edited Powershell script and Run it in Powershell to set logon as a service right.

$Identity = "DomainName\Administrator"
$privilege = "SeServiceLogonRight"

$CarbonDllPath = "C:\Users\Administrator\Downloads\Carbon\bin\Carbon.dll"


[Carbon.Lsa]::GrantPrivileges( $Identity , $privilege)

Powershell output :

Set Logon As A Service right to User by Powershell

Other web site links for Carbon DLL:

Set or Grant User Logon As A Service right/permission to user using C#

You can use the function GrantUserLogOnAsAService to set Logon as a Service right to user using C# code. This function uses the class LsaWrapper.

static void GrantUserLogOnAsAService(string userName)
        LsaWrapper lsaUtility = new LsaWrapper();

        lsaUtility.SetRight(userName, "SeServiceLogonRight");

        Console.WriteLine("Logon as a Service right is granted successfully to " + userName);
    catch (Exception ex)
LsaWrapper class file
public class LsaWrapper
// Import the LSA functions

[DllImport("advapi32.dll", PreserveSig = true)]
private static extern UInt32 LsaOpenPolicy(
    ref LSA_UNICODE_STRING SystemName,
    ref LSA_OBJECT_ATTRIBUTES ObjectAttributes,
    Int32 DesiredAccess,
    out IntPtr PolicyHandle

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]
private static extern long LsaAddAccountRights(
    IntPtr PolicyHandle,
    IntPtr AccountSid,
    LSA_UNICODE_STRING[] UserRights,
    long CountOfRights);

public static extern void FreeSid(IntPtr pSid);

[DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true, PreserveSig = true)]
private static extern bool LookupAccountName(
    string lpSystemName, string lpAccountName,
    IntPtr psid,
    ref int cbsid,
    StringBuilder domainName, ref int cbdomainLength, ref int use);

private static extern bool IsValidSid(IntPtr pSid);

private static extern long LsaClose(IntPtr ObjectHandle);

private static extern int GetLastError();

private static extern long LsaNtStatusToWinError(long status);

// define the structures

private enum LSA_AccessPolicy : long
    POLICY_TRUST_ADMIN = 0x00000008L,
    POLICY_CREATE_ACCOUNT = 0x00000010L,
    POLICY_CREATE_SECRET = 0x00000020L,
    POLICY_AUDIT_LOG_ADMIN = 0x00000200L,
    POLICY_SERVER_ADMIN = 0x00000400L,
    POLICY_LOOKUP_NAMES = 0x00000800L,

    public int Length;
    public IntPtr RootDirectory;
    public readonly LSA_UNICODE_STRING ObjectName;
    public UInt32 Attributes;
    public IntPtr SecurityDescriptor;
    public IntPtr SecurityQualityOfService;

private struct LSA_UNICODE_STRING
    public UInt16 Length;
    public UInt16 MaximumLength;
    public IntPtr Buffer;
//Adds a privilege to an account

/// Name of an account - "domain\account" or only "account"
/// Name ofthe privilege
/// The windows error code returned by LsaAddAccountRights
public long SetRight(String accountName, String privilegeName)
    long winErrorCode = 0; //contains the last error

    //pointer an size for the SID
    IntPtr sid = IntPtr.Zero;
    int sidSize = 0;
    //StringBuilder and size for the domain name
    var domainName = new StringBuilder();
    int nameSize = 0;
    //account-type variable for lookup
    int accountType = 0;

    //get required buffer size
    LookupAccountName(String.Empty, accountName, sid, ref sidSize, domainName, ref nameSize, ref accountType);

    //allocate buffers
    domainName = new StringBuilder(nameSize);
    sid = Marshal.AllocHGlobal(sidSize);

    //lookup the SID for the account
    bool result = LookupAccountName(String.Empty, accountName, sid, ref sidSize, domainName, ref nameSize,
                                    ref accountType);

    //say what you're doing
    Console.WriteLine("LookupAccountName result = " + result);
    Console.WriteLine("IsValidSid: " + IsValidSid(sid));
    Console.WriteLine("LookupAccountName domainName: " + domainName);

    if (!result)
        winErrorCode = GetLastError();
        Console.WriteLine("LookupAccountName failed: " + winErrorCode);
        //initialize an empty unicode-string
        var systemName = new LSA_UNICODE_STRING();
        //combine all policies
        var access = (int) (
                                LSA_AccessPolicy.POLICY_AUDIT_LOG_ADMIN |
                                LSA_AccessPolicy.POLICY_CREATE_ACCOUNT |
                                LSA_AccessPolicy.POLICY_CREATE_PRIVILEGE |
                                LSA_AccessPolicy.POLICY_CREATE_SECRET |
                                LSA_AccessPolicy.POLICY_GET_PRIVATE_INFORMATION |
                                LSA_AccessPolicy.POLICY_LOOKUP_NAMES |
                                LSA_AccessPolicy.POLICY_NOTIFICATION |
                                LSA_AccessPolicy.POLICY_SERVER_ADMIN |
                                LSA_AccessPolicy.POLICY_SET_AUDIT_REQUIREMENTS |
                                LSA_AccessPolicy.POLICY_SET_DEFAULT_QUOTA_LIMITS |
                                LSA_AccessPolicy.POLICY_TRUST_ADMIN |
                                LSA_AccessPolicy.POLICY_VIEW_AUDIT_INFORMATION |
        //initialize a pointer for the policy handle
        IntPtr policyHandle = IntPtr.Zero;

        //these attributes are not used, but LsaOpenPolicy wants them to exists
        var ObjectAttributes = new LSA_OBJECT_ATTRIBUTES();
        ObjectAttributes.Length = 0;
        ObjectAttributes.RootDirectory = IntPtr.Zero;
        ObjectAttributes.Attributes = 0;
        ObjectAttributes.SecurityDescriptor = IntPtr.Zero;
        ObjectAttributes.SecurityQualityOfService = IntPtr.Zero;

        //get a policy handle
        uint resultPolicy = LsaOpenPolicy(ref systemName, ref ObjectAttributes, access, out policyHandle);
        winErrorCode = LsaNtStatusToWinError(resultPolicy);

        if (winErrorCode != 0)
            Console.WriteLine("OpenPolicy failed: " + winErrorCode);
            //Now that we have the SID an the policy,
            //we can add rights to the account.

            //initialize an unicode-string for the privilege name
            var userRights = new LSA_UNICODE_STRING[1];
            userRights[0] = new LSA_UNICODE_STRING();
            userRights[0].Buffer = Marshal.StringToHGlobalUni(privilegeName);
            userRights[0].Length = (UInt16) (privilegeName.Length*UnicodeEncoding.CharSize);
            userRights[0].MaximumLength = (UInt16) ((privilegeName.Length + 1)*UnicodeEncoding.CharSize);

            //add the right to the account
            long res = LsaAddAccountRights(policyHandle, sid, userRights, 1);
            winErrorCode = LsaNtStatusToWinError(res);
            if (winErrorCode != 0)
                Console.WriteLine("LsaAddAccountRights failed: " + winErrorCode);


    return winErrorCode;

Set Logon As A Service right to user via Command Line

You can use the NTRights.exe utility to grant or deny user rights to users and groups from a command line or a batch file. The NTRights.exe utility is included in the Windows NT Server 4.0 Resource Kit Supplement 3. Refer:

Set Logon As A Service right
ntrights +r SeServiceLogonRight -u "Domain\Administrator"
Revoke Logon As A Service right
ntrights -r SeServiceLogonRight -u "Domain\Administrator"

Set or Grant Logon As Service right/privilege to user via VBScript

1. Copy the below example VBScript code and paste it in notepad or a VBScript editor.
2. Change the value for strUserName if you want to give your own name otherwise simply leave it.
3. Save the file with a .vbs extension, for example: SetLogonAsAServiceRight.vbs
4. Double-click the VBScript file (or Run this file from command window) to Set Logon As Service right/permission to user.

' SetLogonAsAServiceRight.vbs
' Sample VBScript to set or grant Logon As A Service Right.
' Author:
' ------------------------------------------------------' 

Dim strUserName,ConfigFileName,OrgStr,RepStr,inputFile,strInputFile,outputFile,obj 
strUserName = "work2008\DevUser"
Dim oShell 
Set oShell = CreateObject ("WScript.Shell")
oShell.Run "secedit /export /cfg config.inf", 0, true 
oShell.Run "secedit /import /cfg config.inf /db database.sdb", 0, true

ConfigFileName = "config.inf"
OrgStr = "SeServiceLogonRight ="
RepStr = "SeServiceLogonRight = " & strUserName & ","
Set inputFile = CreateObject("Scripting.FileSystemObject").OpenTextFile("config.inf", 1,1,-1)
strInputFile = inputFile.ReadAll
Set inputFile = Nothing

Set outputFile =   CreateObject("Scripting.FileSystemObject").OpenTextFile("config.inf",2,1,-1)
outputFile.Write (Replace(strInputFile,OrgStr,RepStr))
Set outputFile = Nothing

oShell.Run "secedit /configure /db database.sdb /cfg config.inf",0,true
set oShell= Nothing

Set obj = CreateObject("Scripting.FileSystemObject")

Msgbox "Logon As A Service Right granted to user '"& strUserName &"' using Vbscript code"

Software Developer



  1. It's very effortlesѕ to finԁ &X6F;ut any matter on &X6e;et aѕ compared to books, as I
    found thіs article at thіs web page.

    Feel free to visit my ρage canada goose solaris

  2. Very helpful. I took your C# example and ran with so it could be used right within PowerShell

  3. I am the owner/maintainer of Carbon. The Carbon.Lsa.GrantPrivileges function is a private API, and is subject to change between releases of Carbon. Please use the privilege functions instead:

    * Get-Privilege
    * Grant-Privilege
    * Test-Privilege
    * Revoke-Privilege

    Not only are these part of Carbon's public API, but they do better error handling. Please update your article to use Grant-Privilege instead of Carbon.Lsa.GrantPrivileges:

    $Identity = "DomainName\Administrator"
    $privilege = "SeServiceLogonRight"

    & "C:\Users\Administrator\Downloads\Carbon-1.5.1\Carbon\Import-Carbon.ps1"

    Grant-Privilege -Identity $Identity -Privilege $privilege

    1. Thanks Aaron. I have done it now... and whishing your good work to continue forever

  4. Thank you Very Very Helpful!
    Even I have to thank Jeffrey Hicks for his C# -> PowerShell Translation

    Greets Peter Kriegel

    Founder member of the European, German speaking, Windows PowerShell Community

  5. Thanks Morgan! This was super helpful.
    I tried running the .vbs script!

    Any idea why 'logon as a service' is not usually enabled even for admin roles?

    1. Hi Aish, I don't know what is the exact reason for this...but I think, windows may designed it to prevent privileged account to use as service account without proper permissions.