Bulk-Editing Windows Privileges with secedit

secedit is Windows’ command-line tool for analyzing and applying security policy — the user-rights assignments (who holds SeTakeOwnershipPrivilege, SeDebugPrivilege, etc.), password policy, and audit policy that live in the local security database. Where icacls edits one file’s DACL at a time, secedit edits privileges in bulk by exporting the policy to a text file, editing it, and re-importing. Microsoft documents the subcommands in the Windows Commands reference.

The export / edit / import cycle

# 1. Dump current security policy to a text file
secedit /export /cfg config.inf
 
# 2. Edit config.inf — under [Privilege Rights], each line is:
#       SeSomePrivilege = *S-1-5-32-544,*S-1-5-...
#    Append the target user's SID (comma-separated) to grant that right.
 
# 3. Re-import into a working database and apply
secedit /import /cfg config.inf /db config.sdb
secedit /configure /db config.sdb /cfg config.inf

The [Privilege Rights] section maps each privilege constant to a comma-separated list of account SIDs. Adding a user means appending their SID to the relevant privilege’s line, then re-applying the template. This is how you grant a right like SeTakeOwnershipPrivilege (see setakeownership-privilege) or SeDebugPrivilege to an account in one shot — and, offensively, how an attacker with admin rights quietly hands a persistence account a dangerous privilege without touching the GUI.

Why bulk beats one-off

• One source of truth: the exported .inf is the full user-rights assignment, so edits are explicit and reviewable (diff before/after).
• Scriptable: the same template can be applied across many hosts, which is the legitimate sysadmin use and the attacker’s lateral-movement use alike.
• /validate checks a template’s syntax before you commit it.

Notes and pitfalls

• The account is referenced by SID, not name — resolve the user to a SID first (whoami /user, or look it up in the exported file alongside existing entries).
• /configure against a fresh .sdb applies the template; getting the database/import order wrong means the change silently doesn’t take.
• secedit edits the local security database; on domain-joined machines, Group Policy will overwrite local user-rights assignments at the next policy refresh.

Related

• setakeownership-privilege — a privilege commonly granted via this mechanism
• icacls — the per-object DACL tool, complement to secedit’s policy-level edits
• windows-ntfs-permissions — the permission model underneath

Sources

• secedit commands
• secedit /export