CODEWITHSUNDEEP
powershellazuresecurity
Muhammad Faizan-Ul-Haq
Muhammad Faizan-Ul-Haq

Reputation: 340

Is there a way to set Security Settings" -> "Local Policies" -> "Security Options" using powershell script

I searched it quite a bit but could not find an easy/straightforward working answer.

I want to update a "Security Option" on windows 10. Local Security Policy -> Local Policies -> Security Options via powershell script. The PC is not part of any domain. (it is a VM in Azure). Is there any cmdlet that will help in editing the values of enteries in "Security Options"

Upvotes: 1

Views: 637

Answers (1)

yamex5
yamex5

Reputation: 194

For the product I work on, it's imperative that the process is automated. I built on @Muhammad Faizan-Ul-Haq's procedure, reading out the local policy INF file line by line, substituting updated rules and then writing the updated file back using Power Shell.
The code below could be made more generic, but does work on Windows 10.

$DefaultPolicyINF  = "C:\Windows\INF\defltbase.inf"
$NewPolicyINF      = "C:\Users\temp\NewPolicyFile.inf"
$SecureEdit        = "C:\WINDOWS\SYSTEM32\SecEdit" 
$BlockRemoteLogons = "SeDenyRemoteInteractiveLogonRight = RDP Logon Block"

New-Item  $NewPolicyINF  -type  file 

foreach( $line in [System.IO.File]::ReadLines( $DefaultPolicyINF ) ) 
{      
       if( $line.Contains( "SeDenyRemoteInteractiveLogonRight" ) )
       {
           Add-Content -Path $NewPolicyINF -Value $BlockRemoteLogons
       }
       else
       {
           Add-Content -Path $NewPolicyINF -Value $line
       }
 }
 
 & $SecureEdit /configure /cfg $NewPolicyINF /db defltbase.sdb /verbose
 
 if ( Test-Path  $NewPolicyINF   ) {    Remove-Item $NewPolicyINF   }
 if ( Test-Path  "defltbase.jfm" ) {    Remove-Item "defltbase.jfm" }
 if ( Test-Path  "defltbase.sdb" ) {    Remove-Item "defltbase.sdb" }

Upvotes: 1

Related Questions