Customizing user privileges for an account in Windows (xp/vista/7)?

Question

I'm a .NET developer and recently learning WINDOWS API. When ever a program starts, my Kaspersky anti-virus says "application belonging to trusted group is trying to set debug previleges". I started wondering what are debug privileges? When ever application tries to open a file (using OpenFileDialog) it gives this message about debug privileges. It sometimes also says the so & so application is trying to read desktop.ini I'm not sure about what exactly it is either.

Any way, my concern is about user previlages. When creating user account. We can only set the account to be either Administrative or Limited user. I read in MSDN that there are so many privileges for a user account.

http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx

SE_ASSIGNPRIMARYTOKEN_NAME
SE_AUDIT_NAME
SE_BACKUP_NAME
SE_CHANGE_NOTIFY_NAME
SE_CREATE_GLOBAL_NAME
SE_CREATE_PAGEFILE_NAME
SE_CREATE_PERMANENT_NAME
SE_CREATE_SYMBOLIC_LINK_NAME
SE_CREATE_TOKEN_NAME
SE_DEBUG_NAME
SE_ENABLE_DELEGATION_NAME
SE_IMPERSONATE_NAME
SE_INC_BASE_PRIORITY_NAME
SE_INCREASE_QUOTA_NAME
SE_INC_WORKING_SET_NAME
SE_LOAD_DRIVER_NAME
SE_LOCK_MEMORY_NAME
SE_MACHINE_ACCOUNT_NAME
SE_MANAGE_VOLUME_NAME
SE_PROF_SINGLE_PROCESS_NAME
SE_RELABEL_NAME
SE_REMOTE_SHUTDOWN_NAME
SE_RESTORE_NAME
SE_SECURITY_NAME
SE_SHUTDOWN_NAME
SE_SYNC_AGENT_NAME
SE_SYSTEM_ENVIRONMENT_NAME
SE_SYSTEM_PROFILE_NAME
SE_SYSTEMTIME_NAME
SE_TAKE_OWNERSHIP_NAME
SE_TCB_NAME
SE_TIME_ZONE_NAME
SE_TRUSTED_CREDMAN_ACCESS_NAME
SE_UNDOCK_NAME
SE_UNSOLICITED_INPUT_NAME

Well, my question is How can I manually (not programatically) set/customize these privileges for a user account? Surprisingly I'm unable to find a PRIVILEGE CONST for registry access. On my lab computer admin has disabled the registry access to my account. Where can I know more information about these information?

I use all 3 operating systems (XP, VISTA, 7) :)

Solution

I am assuming you have admin privileges on your machine. This will not work if you don't have admin privileges.

At the Windows Run Prompt - type secpol.msc. This will load up the local security policy manager. You can then see the security policies that apply to your machine here - look in Local Policies -> User Rights Assignment -> Debug programs. This will show you the users and groups that have debug privileges in your machine. You can modify the setting by double clicking on it :-)