Newsgroup: it.comp.os.win.win2000
Titolo: (Difficult Q) secedit is overwriting security

I am hoping someone can answer my question(s) (I found my same questions
on 
groups.google.com
 but surpringly they were not answered).
My goal:
--------
To script (or programatically) configure the domain controller
security policy.
Requirements:
-------------
Create a new user, give the user permission to 'act as part
of the operating system, 'log on as service', and 'replace a process level
token'.
My attempt:
-----------
I created myself a VB DLL using the ADSI library to create a new user.
Using ADSI, I bind to the new user and get his SID (Security ID).  I then
convert the RAW sid to a String SID (function to do this is from Q286182
http://support.microsoft.com/support/kb/articles/Q286/1/82.ASP?LN=EN-US&SD=gn&FR=0&qry=Q286182&rnk=1&src=DHCS_MSPSS_gn_SRCH&SPR=WIN2000
)
Now, since I know the "string format" of the SID, I create myself a
security template file (in unicode) which looks like:
(note: *S-1-5-21-2052111302-484763869-1957994488-4159 is the SID of my new
user in this example)
--- start file ---
[Unicode]
Unicode = yes
[Version]
signature = "$CHICAGO$"
Revision = 1
[Registry Values]
[Privilege Rights]
SeTcbPrivilege = *S-1-5-21-2052111302-484763869-1957994488-4159
SeServiceLogonRight = *S-1-5-21-2052111302-484763869-1957994488-4159
SeAssignPrimaryTokenPrivilege = *S-1-5-21-2052111302-484763869-1957994488-4159
---- end file ----
Now I save this file to my system and attempt to apply it with secedit.
This is where the problem occurs.  Lets say I saved my file as
"c:\winnt\security\templates\mySecurityTemplate.inf"
I tried scripting:
secedit.exe /configure /DB c:\temp\temp.sdb /CFG 
c:\winnt\security\templates\mySecurityTemplate.inf /areas USER_RIGHTS /verbose
This causes my current security configuration to be OVERWRITTEN!!! :(
Reading the secedit /? documentation, it clearly states that it appends
the security template file.  I dont understand why its overwriting my
security.
One area of secedit I do not fully understand it he required /DB switch.
I have no idea why Microsoft does not fully document its switches, I could
not find a *real* meaning other than its the security database that gets
applied.  I tried using the default security database,
c:\winnt\security\database\secedit.sdb, but when I run secedit using this
database, I get an error:
C:\>secedit /configure /DB "c:\winnt\security\database\secedit.sdb" /CFG
"c:\winnt\security\templates\mySecurityTemplate.inf" /areas USER_RIGHTS
/verbose
Configuring system requires a personal database to work with.
The /DB FileName must be provided. See help for usage on /DB.
However if I provide a new .sdb filename it works (but overwrites the
security).
If anyone can help me out, it would be greately appreciated.
-- 
===============================================qSiG1.6=
[Quentin MacDougall] [
que...@cs.dal.ca
] [ICQ: 5798952]
["Deedee-dada-deedee-dane I just keep on dune methane"]
=======================================================
[Visit my personal website: 
http://xena.dyn.ca/quentin
]

 [Visit my personal website: 
http://xena.dyn.ca/quentin
]
Have you tried using the Sec Analysis & Config MMC snapin? Not sure if this
will work for you, but you can try it by creating the inf as you did with
your settings, and then run an Analysis on itto compare it with the current
machine config and it will ask you for the DB to store it in. You create the
DB by using the default location. Then try your script with this default
location.
Not sure, but hope it helps
Ace