Question

Is there a programattic way to query local security policy settings in C#, i.e. the values in secpol.msc?

I would like to read the “Log on as a batch” setting for some user. What should I do ?

Answer 1

(I can’t really convert this to C# without taking up several pages of code, so I’ll just give a C version.)

You need to:

• Open the local LSA policy using LsaOpenPolicy.
• Open the user’s account using LsaOpenAccount.
• Get their access using LsaGetSystemAccessAccount.
• Test for SECURITY_ACCESS_BATCH_LOGON in the returned value.

The definitions are in ntlsa.h, supplied with the Windows DDK (inc/api).

Sample code (untested):

NTSTATUS status;
OBJECT_ATTRIBUTES objectAttributes = { 0 };
LSA_HANDLE policyHandle;
LSA_HANDLE accountHandle;
ULONG systemAccess;

if (NT_SUCCESS(LsaOpenPolicy(NULL, &objectAttributes, POLICY_LOOKUP_NAMES, &policyHandle)))
{
    if (NT_SUCCESS(LsaOpenAccount(policyHandle, SID_OF_THE_USER, ACCOUNT_VIEW, &accountHandle)))
    {
        if (NT_SUCCESS(LsaGetSystemAccessAccount(accountHandle, &systemAccess)))
        {
            if (systemAccess & SECURITY_ACCESS_BATCH_LOGON)
            {
                // Batch logon allowed!
            }
        }

        LsaClose(accountHandle);
    }

    LsaClose(policyHandle);
}