Define a policy template and apply this template using “secedit”

20.5.2010 von Tim Wanierke.

Create a new policy template

1. Open the MMC SnapIn “Security Templates“.
2. Create a new Template using the context menu “New Template“.
3. Define a name for the template 
    e.g. “DenyLogonLocally”
4. Define the policy as you want 
    e.g. Add a group name to the setting
    “Local Policies -> User Rights Assignment -> Deny logon locally”
5. Save this policy template using the contect menu “Save as …“ 
    This will create a .inf file e.g. “DenyLogonLocally.inf”
     
Apply a policy template using “secedit”
 
1. To apply the policy template create before for example on a DMZ Server 
    where no GPO can be applied just type in the following command.

    secedit /configure /db %temp%\temp.sdb /cfg DenyLogonLocally.inf    

    This command will apply the settings that have been defined within the policy
    template on the computer.

Links:
Security Templates : http://www.windowsecurity.com/articles/Baselining-Security-Templates.html
Secedit : http://technet.microsoft.com/en-us/library/bb490997.aspx
Secedit : http://www.gruppenrichtlinien.de/index.html?/sec/secedit_in_der_CMD.htm

Geschrieben in Microsoft | Drucken | Keine Kommentare »