Windows 2000 Local Security Policy User Rights

In Microsoft Windows 2000, user rights assignments are configured through the Local Security Policy console to control the specific actions users and groups can perform on a local machine. This article explains how Windows 2000 organizes these permissions into logon rights and privileges, how administrators configure them through the Microsoft Management Console (MMC), and how domain-level Group Policy objects interact with local configurations.

Accessing User Rights Assignment

Administrators manage user rights on a standalone or member Windows 2000 machine using the Local Security Policy tool.

  1. Open the Administrative Tools folder from the Start Menu or Control Panel and select Local Security Policy (or run secpol.msc from the Run dialog).
  2. Expand Security Settings.
  3. Expand Local Policies.
  4. Select User Rights Assignment.

The right-hand pane displays the complete list of assignable rights along with the current users or security groups granted each permission.

Types of User Rights

Windows 2000 divides user rights into two distinct categories:

  • Privileges: Rights that authorize users to perform specific system-level operations. Key examples include:
    • Back up files and directories (bypasses file access permissions to create backups)
    • Shut down the system
    • Take ownership of files or other objects
    • Load and unload device drivers
    • Change the system time
  • Logon Rights: Rights that govern how an entity can authenticate and interact with the system. Key examples include:
    • Log on locally (allows physical logon via the console)
    • Access this computer from the network (permits network-based resource connections)
    • Log on as a service (allows service accounts to run background processes)
    • Log on as a batch job (permits scheduled tasks to execute)
    • Deny logon locally and Deny access this computer from the network (explicit restrictions that override allow rights)

Modifying and Applying User Rights

To grant or revoke a right:

  1. Double-click the target policy entry in the right-hand pane.
  2. Check or uncheck Local Policy Setting to enable modification.
  3. Click Add to browse and select local or domain user accounts and security groups.
  4. Highlight an existing account and click Remove to revoke permissions.
  5. Click OK to apply the configuration.

Best practices in Windows 2000 dictate assigning rights to built-in or custom security groups (such as Administrators, Backup Operators, or Power Users) rather than to individual user accounts to streamline administrative overhead.

Active Directory and Group Policy Hierarchy

When a Windows 2000 computer is joined to an Active Directory domain, the Local Security Policy is subject to the standard Group Policy processing order:

  1. Local
  2. Site
  3. Domain
  4. Organizational Unit (OU)

If a user right is defined at the domain or OU level via a Group Policy Object (GPO), it overwrites the setting configured in the machine's Local Security Policy. When a right is not configured at the domain level, the Local Security Policy remains active and enforced. Policy updates can be forced immediately at the command prompt using the secedit /refreshpolicy machine_policy /enforce command.