Check if AD account has "Logon on as a service" right in Active Directory

Question

Is it possible to check if an account has "Logon as service" right programatically. I know how to setup and check this manually but I would like to check it from C# code.

I need to check if this right is enabled on domain level, not just on that particular server.

Edit: I am looking to find out if user "Logon on as a service" is defined at domain group policy level.

Lester

Answer 1

There's a group policy API but it's designed for C/C++ use. Even if you can find a way to query a group policy using it, you still won't know if that policy is applied to machines - whether or not group policy is applied can be very complicated, involving forcing, blocking and lookbacks.

It might be better if you told us what you've trying to achieve, to see if there's another approach that might be more fruitful.

Orthoepy

Answer 2

I think it's per-server, not an AD property at all.

Ion

You can, but if there is Group Policy your settings will be overwritten. That's way I need to check if this setting is AD wide. – Lester

Answer 3

Check the value of the userAccountControl property, which is effectively a flags enum.

I'm sure of the exact flag for "Log on as a service", but you could test against a known user and the values are defined in the documentation on MSDN

Veld