Windows 11 User Rights Assignment: 38 Checks

Checks which accounts hold the right used by Credential Manager during backup and restore.

This rule fails when seTrustedCredManAccessPrivilege is assigned to any account.

Rationale: Only Winlogon needs this right; granting it lets an account retrieve another user's saved credentials.

Impact: None; no account requires this right by default.

Checks which accounts may connect to this computer over the network.

This rule fails when the accounts assigned to seNetworkLogonRight are not exactly Administrators, Remote Desktop Users.

Rationale: Accounts able to reach the machine over the network can access resources they are permitted to; the set should be limited to administrators and remote desktop users.

Impact: Only the listed groups can access the computer across the network.

Checks which accounts may act as part of the operating system.

This rule fails when seTcbPrivilege is assigned to any account.

Rationale: This right lets a process assume any user identity and take complete control of the computer.

Impact: None; the right is rarely required by any legitimate account.

Checks which accounts may adjust the memory quota available to a process.

This rule fails when the accounts assigned to seIncreaseQuotaPrivilege are not exactly Administrators, LOCAL SERVICE, NETWORK SERVICE.

Rationale: An account with this right can starve processes of memory and disrupt business-critical applications.

Impact: Only the listed principals can adjust process memory quotas.

Checks which accounts may log on interactively at the console.

This rule fails when the accounts assigned to seInteractiveLogonRight are not exactly Administrators, Users.

Rationale: Restricting local logon prevents unauthorized users from signing in at the machine's console.

Impact: Only administrators and standard users can log on locally.

Checks which accounts may log on through Remote Desktop Services.

This rule fails when the accounts assigned to seRemoteInteractiveLogonRight are not exactly Administrators, Remote Desktop Users.

Rationale: Limiting RDP logon to administrators and remote desktop users reduces the remote attack surface.

Impact: Only the listed groups can sign in over Remote Desktop.

Checks which accounts may bypass file and directory permissions to perform backups.

This rule fails when the accounts assigned to seBackupPrivilege are not exactly Administrators.

Rationale: This right bypasses ACLs; a non-administrator could copy protected data off the system.

Impact: Only administrators can back up files and directories.

Checks which accounts may change the system clock.

This rule fails when the accounts assigned to seSystemtimePrivilege are not exactly Administrators, LOCAL SERVICE.

Rationale: Altering the clock can invalidate event-log and file timestamps and disrupt time-based authentication.

Impact: Only administrators and LOCAL SERVICE can change the system time.

Checks which accounts may create or resize the pagefile.

This rule fails when the accounts assigned to seCreatePagefilePrivilege are not exactly Administrators.

Rationale: Mis-sizing or relocating the pagefile can degrade system performance.

Impact: Only administrators can create a pagefile.

Checks which accounts may create access tokens.

This rule fails when seCreateTokenPrivilege is assigned to any account.

Rationale: An account with this right can craft tokens granting itself elevated access and fully compromise the host.

Impact: None; no account requires this right by default.

Checks which accounts may create global objects available to all sessions.

This rule fails when the accounts assigned to seCreateGlobalPrivilege are not exactly Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE.

Rationale: Global objects can interfere with services and processes running under other accounts.

Impact: Only the listed principals can create global objects.

Checks which accounts may create permanent shared objects.

This rule fails when seCreatePermanentPrivilege is assigned to any account.

Rationale: This right could be used to create shared objects that expose sensitive data on the network.

Impact: None; kernel-mode components already hold this right inherently.

Checks which accounts may create symbolic links.

This rule fails when the accounts assigned to seCreateSymbolicLinkPrivilege are not exactly Administrators.

Rationale: Symbolic-link creation can be abused for link-following attacks that redirect operations to other targets.

Impact: Only administrators can create symbolic links.

Checks which accounts may attach a debugger to any process or the kernel.

This rule fails when the accounts assigned to seDebugPrivilege are not exactly Administrators.

Rationale: Debug rights grant full access to process and kernel memory and are used to extract credentials and code.

Impact: Only administrators can debug programs.

Checks that network logon is denied to the Guests group.

This rule fails when seDenyNetworkLogonRight does not include the Guests group.

Rationale: Blocking guest network logon prevents anonymous enumeration and access to shared resources.

Impact: Guests can no longer access the computer over the network.

Checks that batch-job logon is denied to the Guests group.

This rule fails when seDenyBatchLogonRight does not include the Guests group.

Rationale: Guests with batch logon could schedule resource-consuming or malicious jobs.

Impact: Guests can no longer log on as a batch job.

Checks that service logon is denied to the Guests group.

This rule fails when seDenyServiceLogonRight does not include the Guests group.

Rationale: Guests able to log on as a service could register unauthorized or malicious services.

Impact: Guests can no longer log on as a service.

Checks that local logon is denied to the Guests group.

This rule fails when seDenyInteractiveLogonRight does not include the Guests group.

Rationale: Guests able to log on locally could access the console and installed data.

Impact: Guests can no longer log on at the console.

Checks that Remote Desktop logon is denied to the Guests group.

This rule fails when seDenyRemoteInteractiveLogonRight does not include the Guests group.

Rationale: Guests able to log on over Remote Desktop could reach the remote console of the machine.

Impact: Guests can no longer sign in over Remote Desktop.

Checks which accounts may mark computer and user accounts as trusted for delegation.

This rule fails when seEnableDelegationPrivilege is assigned to any account.

Rationale: Misuse allows impersonation of other users and access to network resources under their identity.

Impact: None; this right is not required on a standalone workstation.

Checks which accounts may shut the computer down remotely.

This rule fails when the accounts assigned to seRemoteShutdownPrivilege are not exactly Administrators.

Rationale: Anyone with this right could trigger a denial of service by shutting the machine down.

Impact: Only administrators can force a remote shutdown.

Checks which accounts may write records to the Security event log.

This rule fails when the accounts assigned to seAuditPrivilege are not exactly LOCAL SERVICE, NETWORK SERVICE, RESTRICTED SERVICES\PrintSpoolerService.

Rationale: An account with this right could flood the Security log to hide malicious activity.

Impact: Only the listed service principals can generate security audit events.

Checks which accounts may impersonate a client after authentication.

This rule fails when the accounts assigned to seImpersonatePrivilege are not exactly Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE, RESTRICTED SERVICES\PrintSpoolerService.

Rationale: An account with this right could trick a client into connecting and then impersonate it.

Impact: Only the listed principals can impersonate an authenticated client.

Checks which accounts may raise the scheduling priority of a process.

This rule fails when the accounts assigned to seIncreaseBasePriorityPrivilege are not exactly Administrators, Window Manager\Window Manager Group.

Rationale: Raising a process to real-time priority can starve all other processes and cause a denial of service.

Impact: Only administrators and the Window Manager group can raise scheduling priority.

Checks which accounts may load and unload device drivers.

This rule fails when the accounts assigned to seLoadDriverPrivilege are not exactly Administrators.

Rationale: Drivers run as privileged kernel code; this right could be used to load malicious code into the kernel.

Impact: Only administrators can load and unload device drivers.

Checks which accounts may lock pages in physical memory.

This rule fails when seLockMemoryPrivilege is assigned to any account.

Rationale: Locking large amounts of memory can starve other processes and cause a denial of service.

Impact: None; no account requires this right by default.

Checks which accounts may log on using the task scheduler service.

This rule fails when the accounts assigned to seBatchLogonRight are not exactly Administrators.

Rationale: Limiting batch logon reduces the ways scheduled tasks can be abused to run code.

Impact: Only administrators can log on as a batch job.

Checks which accounts may register a process as a service.

This rule fails when seServiceLogonRight is assigned to any account.

Rationale: Service logon lets code run continuously even when no one is signed in and should be tightly controlled.

Impact: None; assign the right only to specific service accounts if a component requires it.

Checks which accounts may configure object auditing and clear the Security log.

This rule fails when the accounts assigned to seSecurityPrivilege are not exactly Administrators.

Rationale: This right allows clearing the Security log to erase evidence of an attack.

Impact: Only administrators can manage auditing and the Security log.

Checks which accounts may change the integrity label of objects owned by others.

This rule fails when seRelabelPrivilege is assigned to any account.

Rationale: Changing an object's integrity label could cause code to run at a higher privilege than intended.

Impact: None; no account requires this right by default.

Checks which accounts may modify system firmware environment values.

This rule fails when the accounts assigned to seSystemEnvironmentPrivilege are not exactly Administrators.

Rationale: Altering firmware values could misconfigure hardware and cause data corruption or failure.

Impact: Only administrators can modify firmware environment values.

Checks which accounts may perform volume and disk maintenance tasks.

This rule fails when the accounts assigned to seManageVolumePrivilege are not exactly Administrators.

Rationale: This right could be used to delete a volume, causing data loss or a denial of service.

Impact: Only administrators can perform volume maintenance tasks.

Checks which accounts may profile the performance of individual processes.

This rule fails when the accounts assigned to seProfileSingleProcessPrivilege are not exactly Administrators.

Rationale: Process profiling could help an attacker identify critical processes to target.

Impact: Only administrators can profile a single process.

Checks which accounts may profile overall system performance.

This rule fails when the accounts assigned to seSystemProfilePrivilege are not exactly Administrators, NT SERVICE\WdiServiceHost.

Rationale: System profiling could reveal critical processes an attacker may wish to target.

Impact: Only administrators and the diagnostics service host can profile system performance.

Checks which accounts may replace the token of a process.

This rule fails when the accounts assigned to seAssignPrimaryTokenPrivilege are not exactly LOCAL SERVICE, NETWORK SERVICE.

Rationale: This right lets a caller start processes under other users' credentials, hiding unauthorized activity.

Impact: Only LOCAL SERVICE and NETWORK SERVICE can replace a process-level token.

Checks which accounts may bypass permissions to restore files and directories.

This rule fails when the accounts assigned to seRestorePrivilege are not exactly Administrators.

Rationale: This right bypasses ACLs and could overwrite newer data or restore malicious files.

Impact: Only administrators can restore files and directories.

Checks which accounts logged on locally may shut the system down.

This rule fails when the accounts assigned to seShutdownPrivilege are not exactly Administrators, Users.

Rationale: Shutdown should be available to authorized users but not to guests or unauthorized accounts.

Impact: Only administrators and standard users can shut down the system.

Checks which accounts may take ownership of files and other objects.

This rule fails when the accounts assigned to seTakeOwnershipPrivilege are not exactly Administrators.

Rationale: Taking ownership bypasses any permissions and lets the holder gain control of any object.

Impact: Only administrators can take ownership of files or other objects.