Achtung! Der Code vergibt zuerst das Recht an den Administrator, und entzieht es Ihm gleich wieder
-> wer dieses Recht gesetzt hatte, weil er einen Dienst unter diesem Account am laufen hat, sollte anschliessend das Recht wieder hinzufügen.
Kontrollieren lässt sich das per PolicyEditor unter
"Computer Konfiguration"\"Windows Einstellungen"\"Sicherheitseinstellungen"\"Lokale Richtlinien"\"zuweisen von Benutzerrechten"\"Als Dienst anmelden".
Code: Alles auswählen
#POLICY_VIEW_LOCAL_INFORMATION = $1
#POLICY_VIEW_AUDIT_INFORMATION = $2
#POLICY_GET_PRIVATE_INFORMATION = $4
#POLICY_TRUST_ADMIN = $8
#POLICY_CREATE_ACCOUNT = $10
#POLICY_CREATE_SECRET = $20
#POLICY_CREATE_PRIVILEGE = $40
#POLICY_SET_DEFAULT_QUOTA_LIMITS = $80
#POLICY_SET_AUDIT_REQUIREMENTS = $100
#POLICY_AUDIT_LOG_ADMIN = $200
#POLICY_SERVER_ADMIN = $400
#POLICY_LOOKUP_NAMES = $800
#POLICY_NOTIFICATION = $1000
#POLICY_ALL_ACCESS = $1 | $2 | $4 | $8 | $10 | $20 | $40 | $80 | $100 | $200 | $400 | $800 | $1000
#STATUS_SUCCESS = 0
#STATUS_ACCESS_DENIED = $C0000022
#STATUS_INSUFFICIENT_RESOURCES = $C000009A
#STATUS_INTERNAL_DB_ERROR = $C0000158
#STATUS_INVALID_HANDLE = $C0000008
#STATUS_INVALID_SERVER_STATE = $C00000DC
#STATUS_INVALID_PARAMETER = $C000000D
#STATUS_NO_SUCH_PRIVILEGE = $C0000060
#STATUS_PRIVILEGE_NOT_HELD = $C0000061
#STATUS_INVALID_ACCOUNT_NAME = $C0000062
#STATUS_OBJECT_NAME_NOT_FOUND = $C0000034
#STATUS_UNSUCCESSFUL = $C0000001
Structure LSA_OBJECT_ATTRIBUTES
Length.l
RootDirectory.l
ObjectName.s
Attributes.l
SecurityDescriptor.l
SecurityQualityOfService.l
EndStructure
Structure LSA_UNICODE_STRING
Length.w
MaximumLength.w
buffer.s
EndStructure
Procedure.l Ansi2Uni2(ansistr.s)
lenA.l = Len(ansistr)
lenW = MultiByteToWideChar_(#CP_ACP, 0, ansistr, lenA, 0, 0)
If (lenW > 0) ; Check whether conversion was successful
unicodestr = SysAllocStringLen_(0, lenW)
MultiByteToWideChar_(CP_ACP, 0, ansistr, lenA, unicodestr, lenW)
result = unicodestr
SysFreeString_(unicodestr)
ProcedureReturn result
Else
ProcedureReturn 0
EndIf
EndProcedure
Procedure.l Account2SID(InUser.s)
*username = AllocateMemory(256)
PokeS(*username, InUser.s)
; erster Aufruf liefert die erforderlichen Puffergroessen
rc.l = LookupAccountName_(#Null, *username, #Null, @sidbuflen, #Null, @dnbuflen, @sidtype)
If dnbuflen=0
ProcedureReturn 0
Else
*domainname = AllocateMemory(dnbuflen)
*sid = AllocateMemory(sidbuflen)
rc = LookupAccountName_(#Null, *username, *sid, @sidbuflen, *domainname, @dnbuflen, @sidtype)
domain.s = PeekS(*domainname)
ProcedureReturn *sid
EndIf
EndProcedure
Procedure AddAccountRight(Username.s, AccountRight.s)
Dim UserRights.LSA_UNICODE_STRING(1)
ObjectAttributes.LSA_OBJECT_ATTRIBUTES
ObjectAttributes\Length = SizeOf(LSA_OBJECT_ATTRIBUTES)
dwAccess.l = #POLICY_ALL_ACCESS
PolicyHandle.l = 0
If LsaOpenPolicy_(0, @ObjectAttributes, dwAccess.l, @PolicyHandle.l) = #STATUS_SUCCESS
PolicyLength.l = (Len(AccountRight.s) + 1) * 2
*ptr = AllocateMemory(PolicyLength.l)
*ptr = Ansi2Uni2(AccountRight.s)
UserRights(0)\buffer = Space(PolicyLength.l)
CopyMemory(*ptr, @UserRights(0)\buffer, PolicyLength.l)
UserRights(0)\Length = PolicyLength.l - 2
UserRights(0)\MaximumLength = PolicyLength.l
res.l = LsaAddAccountRights_(PolicyHandle.l, Account2SID(Username.s), @UserRights(0), 1)
LSAClose_(PolicyHandle.l)
ProcedureReturn res.l
EndIf
EndProcedure
Procedure DelAccountRight(Username.s, AccountRight.s)
Dim UserRights.LSA_UNICODE_STRING(1)
ObjectAttributes.LSA_OBJECT_ATTRIBUTES
ObjectAttributes\Length = SizeOf(LSA_OBJECT_ATTRIBUTES)
dwAccess.l = #POLICY_ALL_ACCESS
PolicyHandle.l = 0
If LsaOpenPolicy_(0, @ObjectAttributes, dwAccess.l, @PolicyHandle.l) = #STATUS_SUCCESS
PolicyLength.l = (Len(AccountRight.s) + 1) * 2
*ptr = AllocateMemory(PolicyLength.l)
*ptr = Ansi2Uni2(AccountRight.s)
UserRights(0)\buffer = Space(PolicyLength.l)
CopyMemory(*ptr, @UserRights(0)\buffer, PolicyLength.l)
UserRights(0)\Length = PolicyLength.l - 2
UserRights(0)\MaximumLength = PolicyLength.l
res.l = LsaRemoveAccountRights_(PolicyHandle.l, Account2SID(Username.s),0 , @UserRights(0), 1)
LSAClose_(PolicyHandle.l)
ProcedureReturn res.l
EndIf
EndProcedure
Debug AddAccountRight("Administrator", "SeServiceLogonRight")
Debug DelAccountRight("Administrator", "SeServiceLogonRight")
.