PowerShell: Adding Privileges to a User

Write-Host -NoNewline "Denying interactive (desktop) login with account SomeUser..."
[AnLsaSecurityWrapper.LsaWrapperCaller]::AddPrivileges("SomeUser", "SeDenyInteractiveLogonRight")
Write-Host "done."

# Code from https://www.wildtechgarden.com/doc/sysadmin-devops/powershell-on-windows-adding-security-privileges-to-a-user

# Which is based on PowerShell from https://stackoverflow.com/a/14469248 and .NET
# code from https://stackoverflow.com/a/10188472

# Code adds a Win32 API class to PowerShell so we can use one
# of its methods (LsaAddAccountRights) to add the
# SeDenyInteractiveLogonRight to a user which only exists for
# background processing

Add-Type @'
using System;

namespace AnLsaSecurityWrapper
{
    using System.ComponentModel;
    using System.Runtime.InteropServices;
    using System.Security;
    using System.Security.Principal;
    using LSA_HANDLE = IntPtr;

    [StructLayout(LayoutKind.Sequential)]
    struct LSA_OBJECT_ATTRIBUTES
    {
      internal int Length;
      internal IntPtr RootDirectory;
      internal IntPtr ObjectName;
      internal int Attributes;
      internal IntPtr SecurityDescriptor;
      internal IntPtr SecurityQualityOfService;
    }

    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
    struct LSA_UNICODE_STRING
    {
      internal ushort Length;
      internal ushort MaximumLength;
      [MarshalAs(UnmanagedType.LPWStr)]
      internal string Buffer;
    }

    sealed class Win32Sec
    {
      [DllImport("advapi32", CharSet = CharSet.Unicode, SetLastError = true), SuppressUnmanagedCodeSecurityAttribute]
      internal static extern uint LsaOpenPolicy(
          LSA_UNICODE_STRING[] SystemName,
          ref LSA_OBJECT_ATTRIBUTES ObjectAttributes,
          int AccessMask,
          out IntPtr PolicyHandle
      );

      [DllImport("advapi32", CharSet = CharSet.Unicode, SetLastError = true), SuppressUnmanagedCodeSecurityAttribute]
      internal static extern uint LsaAddAccountRights(
          LSA_HANDLE PolicyHandle,
          IntPtr pSID,
          LSA_UNICODE_STRING[] UserRights,
          int CountOfRights
      );

      [DllImport("advapi32")]
      internal static extern int LsaNtStatusToWinError(int NTSTATUS);

      [DllImport("advapi32")]
      internal static extern int LsaClose(IntPtr PolicyHandle);

    }

    sealed class Sid : IDisposable
    {
      public IntPtr pSid = IntPtr.Zero;
      public SecurityIdentifier sid = null;

      public Sid(string account)
      {
          sid = (SecurityIdentifier) (new NTAccount(account)).Translate(typeof(SecurityIdentifier));
          Byte[] buffer = new Byte[sid.BinaryLength];
          sid.GetBinaryForm(buffer, 0);

          pSid = Marshal.AllocHGlobal(sid.BinaryLength);
          Marshal.Copy(buffer, 0, pSid, sid.BinaryLength);
      }

      public void Dispose()
      {
          if (pSid != IntPtr.Zero)
          {
            Marshal.FreeHGlobal(pSid);
            pSid = IntPtr.Zero;
          }
          GC.SuppressFinalize(this);
      }
      ~Sid()
      {
          Dispose();
      }
    }

    public sealed class LsaWrapper : IDisposable
    {
      enum Access : int
      {
          POLICY_READ = 0x20006,
          POLICY_ALL_ACCESS = 0x00F0FFF,
          POLICY_EXECUTE = 0X20801,
          POLICY_WRITE = 0X207F8
      }
      const uint STATUS_ACCESS_DENIED = 0xc0000022;
      const uint STATUS_INSUFFICIENT_RESOURCES = 0xc000009a;
      const uint STATUS_NO_MEMORY = 0xc0000017;

      IntPtr lsaHandle;

      public LsaWrapper()
          : this(null)
      { }
      // // local system if systemName is null
      public LsaWrapper(string systemName)
      {
          LSA_OBJECT_ATTRIBUTES lsaAttr;
          lsaAttr.RootDirectory = IntPtr.Zero;
          lsaAttr.ObjectName = IntPtr.Zero;
          lsaAttr.Attributes = 0;
          lsaAttr.SecurityDescriptor = IntPtr.Zero;
          lsaAttr.SecurityQualityOfService = IntPtr.Zero;
          lsaAttr.Length = Marshal.SizeOf(typeof(LSA_OBJECT_ATTRIBUTES));
          lsaHandle = IntPtr.Zero;
          LSA_UNICODE_STRING[] system = null;
          if (systemName != null)
          {
            system = new LSA_UNICODE_STRING[1];
            system[0] = InitLsaString(systemName);
          }

          uint ret = Win32Sec.LsaOpenPolicy(system, ref lsaAttr,
          (int) Access.POLICY_ALL_ACCESS, out lsaHandle);
          if (ret == 0)
            return;
          if (ret == STATUS_ACCESS_DENIED)
          {
            throw new UnauthorizedAccessException();
          }
          if ((ret == STATUS_INSUFFICIENT_RESOURCES) || (ret == STATUS_NO_MEMORY))
          {
            throw new OutOfMemoryException();
          }
          throw new Win32Exception(Win32Sec.LsaNtStatusToWinError((int) ret));
      }

      public void AddPrivileges(string account, string privilege)
      {
          uint ret = 0;
          using (Sid sid = new Sid(account))
          {
            LSA_UNICODE_STRING[] privileges = new LSA_UNICODE_STRING[1];
            privileges[0] = InitLsaString(privilege);
            ret = Win32Sec.LsaAddAccountRights(lsaHandle, sid.pSid, privileges, 1);
          }
          if (ret == 0)
            return;
          if (ret == STATUS_ACCESS_DENIED)
          {
            throw new UnauthorizedAccessException();
          }
          if ((ret == STATUS_INSUFFICIENT_RESOURCES) || (ret == STATUS_NO_MEMORY))
          {
            throw new OutOfMemoryException();
          }
          throw new Win32Exception(Win32Sec.LsaNtStatusToWinError((int) ret));
      }

      public void Dispose()
      {
          if (lsaHandle != IntPtr.Zero)
          {
            Win32Sec.LsaClose(lsaHandle);
            lsaHandle = IntPtr.Zero;
          }
          GC.SuppressFinalize(this);
      }
      ~LsaWrapper()
      {
          Dispose();
      }
      // helper functions

      static LSA_UNICODE_STRING InitLsaString(string s)
      {
          // Unicode strings max. 32KB
          if (s.Length > 0x7ffe)
            throw new ArgumentException("String too long");
          LSA_UNICODE_STRING lus = new LSA_UNICODE_STRING();
          lus.Buffer = s;             lus.Length = (ushort) (s.Length * sizeof(char));
          lus.MaximumLength = (ushort) (lus.Length + sizeof(char));
          return lus;
      }
    }

    public class LsaWrapperCaller
    {
        public static void AddPrivileges(string account, string privilege)
        {
            using (LsaWrapper lsaWrapper = new LsaWrapper())
            {
                lsaWrapper.AddPrivileges(account, privilege);
            }
        }
    }
}
'@

Write-Host -NoNewline "Denying interactive (desktop) login with account SomeUser..."
[AnLsaSecurityWrapper.LsaWrapperCaller]::AddPrivileges("SomeUser", "SeDenyInteractiveLogonRight")
Write-Host "done."