Jira (PUP-10547) Manage user rights on Windows

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment#:~:text=User%20rights%20permissions%20control%20access,Policy%20name%20associated%20with%20it.

Issue Type:	Bug
Assignee:	Unassigned
Created:	2020/06/23 11:37 PM
Priority:	Medium
Reporter:	Luchian Nemes

As a continuation for PUP-1289 feature, we should consider the ability to grant/remove users' logon as a service right with puppet. Without this right, the user cannot be used as logon account for a service.

This would also help better testing PUP-1289 through acceptance tests.

Other rights can be considered:

Some useful links found for implementation:

https://docs.microsoft.com/en-us/windows/win32/secbp/assigning-privileges-to-an-account

https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsaaddaccountrights

https://github.com/microsoft/Windows-classic-samples/blob/master/Samples/Win7Samples/security/lsapolicy/lsaprivs/LsaPrivs.c

This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935)

Luchian Nemes (Jira)

unread,

Jun 24, 2020, 2:39:02 AM6/24/20

to puppe...@googlegroups.com

Luchian Nemes updated an issue

Puppet /

Change By:	Luchian Nemes
Issue Type:	Bug New Feature

Luchian Nemes (Jira)

unread,

Jun 24, 2020, 2:39:04 AM6/24/20

to puppe...@googlegroups.com

Luchian Nemes updated an issue

Puppet /

[ https://github.com/microsoft/Windows-classic-samples/blob/master/Samples/Win7Samples/security/lsapolicy/lsaprivs/LsaPrivs.c ]

Change By:	Luchian Nemes

As a continuation for [ PUP-1289 |https://tickets.puppetlabs.com/browse/PUP-1289] feature, we should consider the ability to grant/remove users' logon as a service right with puppet. Without this right, the user cannot be used as logon account for a service.

This would also help better testing [ PUP-1289 |https://tickets.puppetlabs.com/browse/PUP-1289] through acceptance tests.

Other rights can be considered:

[https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment#:~:text=User%20rights%20permissions%20control%20access,Policy%20name%20associated%20with%20it.]

Some useful links found for implementation:

[ https://docs.microsoft.com/en-us/windows/win32/secbp/assigning-privileges-to-an-account ]

[ https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsaaddaccountrights ]

Mihai Buzgau (Jira)

unread,

Jun 24, 2020, 5:28:03 AM6/24/20

to puppe...@googlegroups.com

Mihai Buzgau updated an issue

Puppet /

Change By:	Mihai Buzgau
Story Points:	5

Mihai Buzgau (Jira)

unread,

Jun 24, 2020, 5:29:06 AM6/24/20

to puppe...@googlegroups.com

Mihai Buzgau updated an issue

Puppet /

Change By:	Mihai Buzgau
Sprint:	PR NW - Triage 2020-06-08

Luchian Nemes (Jira)

unread,

Jun 26, 2020, 3:18:03 AM6/26/20

to puppe...@googlegroups.com

Luchian Nemes assigned an issue to Luchian Nemes

Puppet /

Change By:	Luchian Nemes
Assignee:	Luchian Nemes

Mihai Buzgau (Jira)

unread,

Jul 8, 2020, 3:40:03 AM7/8/20

to puppe...@googlegroups.com

Mihai Buzgau updated an issue

Puppet /

Change By:	Mihai Buzgau
Sprint:	NW - 2020-07-08 , NW - 2020-07-21

Mihai Buzgau (Jira)

unread,

Jul 23, 2020, 3:28:03 AM7/23/20

to puppe...@googlegroups.com

Mihai Buzgau updated an issue

Puppet /

Change By:	Mihai Buzgau
Sprint:	NW - 2020-07-08, NW - 2020-07-21 , NW - 2020-08-06

Luchian Nemes (Jira)

unread,

Jul 24, 2020, 10:57:03 AM7/24/20

to puppe...@googlegroups.com

Luchian Nemes updated an issue

Puppet /