ntrights equivalent/replacement for Server 2008

Question

Does anyone know what or if there exists a replacement utility for the Server 2000/Server 2003 command line tool ntrights on Server 2008? More info on this utility (for those that don't know what it is) is in MSDN KB 315276.

Solution 1

NTRights seems to function properly on my 2k8 systems. You should be able to continue to use the utility.

Solution 2

Powershell Community Extensions has a Set-Privilege cmdlet that can be used to set user rights. (And a Get-Privilege to get user rights.)

Comments

[Spence]

If you're developing commercial software, please don't use tools like NTRIGHTS in conjunction with deployment of your software. Oftentimes I prefer to use GPOs to assign user rights because its easy to move servers around in AD when computer roles change, and the right user rights assignments "just happen" when I use GPOs. When software uses NTRIGHTS to modify the local security policy on my servers I end up just having to undo the changes it makes and put those changes into a GPO.

[Chris J]

@Evan - it's two pronged: [1] when I'm admin'ing servers, the more I can do from the command line, the better. And [2] Yes, deployment is part of it, but it's not a step we'd run automatically: it's a script that would be provided as a convienence for those that find it, erm, convienient, rather than clicking through local security policy. Agree that a lot of stuff can be pushed down through GPO, and folk do have the option of not running the script and applying them through other means. Instructions provided with the software give enough detail for either option.

[Spence]

I'm all for command-line. I've grown less comfortable w/ anything config'd locally on Windows Server machines. In the way configuration management systems like Puppet or Chef work in the *nix world, I see Active Directory and GPOs as being the method to insure many aspects of server configuration are "pushed out". Further, I consider all machines to be temporary, and I like to plan for how I'm going to deploy a replacement. Forcing out config thru GPOs helps me have a consistent replacement machine, down the road. At least your script lets an admin like me have an option.

[Spence]

+1 - I'm seeing the same behaviour here.

[Chris J]

I'll go with this then :-) Was wondering if MS now supplied it (or something similar) as standard. If not, this'll do :-)