How to Add or Remove Users and Groups from "User Rights Assignment" in Windows
Information
User Rights Assignment policies determines which users or groups have logon rights or privileges on the computer. This will show you how to add (assign) or remove users and groups for each User Rights Assignment policy in Vista, Windows 7, or Windows 8.
You must be logged in as an administrator to be able to do the steps in this tutorial.
Note
If you remove a user or group, then that
user or group will no longer be able to perform the policy on the computer.
If you add a user or group, then that
user or group will now be able to perform the policy on the computer.
For more information about each specific user rights policy, see:
User Rights
Warning
This tutorial is not for a beginner to try.
I would highly recommend that you
create a restore point before making changes to the User Rights Assignment. This way if you make a mistake and lock yourself, a user, or a group out of a policy that you didn't want to, you will be able to do a
system restore at boot and select the restore point to undo the mistake.
OPTION ONE
Through Local Security Policy
1. Open the
Local Security Policy window, expand
Local Policies in the left pane, and select
User Rights Assignment. (see screenshot below)
2. In the right pane of
User Rights Assignment, double click on a listed
Policy (ex: Shut down the system) that you wanted to add or remove a user or group, then go to
step 3 and/or 4 below. (see screenshot above)
3. To Remove a User or Group from a User Rights Assignment Policy A) Select (highlight) a listed user(s) and/or group(s) that you wanted to remove from the policy, then click on the
Remove button. (see screenshot below)
NOTE: You can press and hold the CTRL key to select more than one listed user (user account name) and/or group.
B) Click on
Apply. (see screenshot below)
C) Go to
step 4 or 5 for what you would like to do.
4. To Add a User or Group to a User Rights Assignment Policy
A) Click on the
Add User or Group button. (see screenshot above)
B) Click on the
Advanced button. (see screenshot below)
C) Click on the
Object Types button. (see screenshot below)
D) Check only the
Users and
Groups boxes, and click on
OK. (see screenshot below)
E) Click on the
Find Now button. (see screenshot below)
F) In the bottom pane under
Search results, select the user(s) and/or group(s) that you wanted to add to the policy, then click on
OK. (see screenshot below)
NOTE: You can press and hold the CTRL key to select more than one listed user (user account name) and/or group.
G) Click on
OK. (see screenshot below)
H) Click on
Apply. (see screenshot below)
5. When finished, click on OK. (see screenshots below steps 3B and 4H)
6. Close the Local Security Policy window. (see screenshot below step 1)
OPTION TWO
Using an Elevated Command Prompt
Download
A) Open the downloaded
.zip file, and extract (drag and drop) the
ntrights.exe file to your desktop.
B) Right click on the
ntrights.exe file, click on
Properties,
General tab, and click on the
Unblock button if available.
NOTE: If you do not have a Unblock button under the General tab, then the file is already unblocked and you can continue on to step 1C.
C) Right click on the
ntrights.exe file and click on
Move.
D) Open Windows Explorer and navigate to and open the
C:\Windows\System32 folder, then
Paste the
ntrights.exe file to move it here.
E) If prompted, click on
Continue and
Yes to approve moving the
ntrights.exe file into the
System32 folder, then close the Windows Explorer window.
2. Open an
elevated command prompt, and do
step 3 and/or 4 below.
3. To Remove a User or Group from a User Rights Assignment Policy
A) In the elevated command prompt, type the command below for what user or group that you would like to remove from what policy, and press Enter.
NOTE: See blue note box below step 4.
ntrights -U "User or Group" -R PolicyConstantName
For example: If I wanted to remove the standard users group "Users" from being able to "Shut down the system", then I would type the command below.
ntrights -U "Users" -R SeShutdownPrivilege
B) Go to
step 4 or 5 for what you would like to do.
4. To Add a User or Group to a User Rights Assignment PolicyA) In the elevated command prompt, type the command below for what user or group that you would like to add to what policy, and press Enter.
NOTE: See blue note box below step 4.
ntrights -U "User or Group" +R PolicyConstantName
For example: If I wanted to add the standard users group "Users" to be able to "Shut down the system", then I would type the command below.
ntrights -U "Users" +R SeShutdownPrivilege
Note
Substitute
User or Group in the command with actual name of the user account or group within quotes.
Substitute
PolicyConstantName in the command for the actual
Constant Name at the link below for the
Group Policy Name that you wanted to add or remove a user or group.
5. When finished, close the elevated command prompt.
That's it,
Shawn