How to properly export live settings in GPO applied to a machine

Question

How to properly export live settings in GPO applied to a machine

Egoitz Aurrekoetxea 81

Hi,

I needed to get which of the following settings, and with which values, are applied live on a server. The needed settings are :

SeInteractiveLogonRight

SeRemoteInteractiveLogonRight

SeDenyInteractiveLogonright

SeDenyRemoteInteractiveLogonRight

It seems I'm achieving it by doing :

Secedit /Export /Areas User_Rights /cfgSecedit /Export /Areas User_Rights /cfg c:\undirectorio\gpo.txt

Later by checking the file I achieve my goal.

I normally check too this other command file generated :

Secedit /Export /Areas SECURITYPOLICY /cfg Secedit /Export /Areas SECURITYPOLICY /cfg c:\undirectorio\gpo.txt

They seem to give me what I need even when for instance "SeDenyInteractiveLogonright" is set in the local gpo and set too in a gpo applied to the OU where the server belongs. The behavior is the expected one. I get in the secedit output the value set in active directory GPO in the OU.

So, my question basically is... is this way the correct one of achieving my goal of getting dump in a plain text file the live settings of the policy applied to the virtual machine?. I can have only a local gpo or could have a local gpo (with default values or not) and later n number of gpo applied at different levels in active directory (site, domain, ou... etc...). So the real question is, my secedit command should give me what I'm trying to get and then to have live seetings in the machine (after all gpo at differrent levels are applied) ?.

I have seen too that there is a flag /mergedpolicy but it seems to just output then those values that I have applied at local policy and too at active directory policy?. Am I wrong?.

Best regards

Thank you so much,

0 comments

Answer accepted by question author

AI answer

Using secedit /export with the user_rights (and optionally securitypolicy) area is a correct way to dump the effective local security policy (including merged GPO settings) as it exists on the machine at the time of export.

Key points based on the secedit behavior in the provided documentation:

secedit /export exports from the local security database
- secedit /export “exports security settings stored in a database configured with security templates.”
- If /db is not specified, it uses the system security database in %windir%\security\database.
- That database reflects the current local security policy after Group Policy processing has updated it.
Using /areas user_rights is appropriate for the Se* logon rights
- The user_rights area explicitly covers “User logon rights and granting of privileges.”
- Therefore, SeInteractiveLogonRight, SeRemoteInteractiveLogonRight, SeDenyInteractiveLogonRight, and SeDenyRemoteInteractiveLogonRight are included when exporting /areas user_rights.
Example pattern (simplified):
```
   secedit /export /areas user_rights /cfg C:\undirectorio\gpo.txt
```
/areas securitypolicy is optional but valid
- securitypolicy covers “Local policy and domain policy for the system, including account policies, audit policies, security options, and so on.”
- It is not required for the four specific Se* logon rights (those are in user_rights), but exporting it can give a broader view of other security settings.
Effective vs. individual GPOs
- secedit /export does not export per‑GPO data; it exports what is in the local security database after Group Policy processing.
- When multiple GPOs (local + AD GPOs at site/domain/OU) apply, the resulting values written into the local security database are what secedit /export shows. That matches the “live” effective policy on the machine.
About /mergedpolicy
- /mergedpolicy is a switch on secedit /export that “merges and exports domain and local policy security settings.”
- When used, it exports the merged view of domain and local policy security settings. It is not limited to “only values that exist in both local and AD policy”; it is intended to output the merged result.
- Example from documentation:
```
     secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quiet
```
Practical guidance
- To capture the effective live settings for the logon rights on a server after all GPOs have applied:
  1. Ensure Group Policy is refreshed (for example, gpupdate /force if needed).
  2. Run secedit /export against the system database with /areas user_rights (and optionally /mergedpolicy if exporting from a custom DB with /db).
  3. Inspect the resulting .inf/text file for the Se* entries.

Within the documented behavior, this method is appropriate for dumping the effective user-rights assignments as they are applied on the machine.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

3 additional answers

Your answer

Answer 1

Egoitz Aurrekoetxea 81

By the way, when you say :

--When used, it exports the merged view of domain and local policy security settings. It is not limited to “only values that exist in both local and AD policy”; it is intended to output the merged result--

You mean that if for instance 4 gpo (local and some other) are applied to a vm in the case that for instance SeInterativeLoginright is configured in all of them with a different user in each, with the /mergedpolicy I would see 4 users in that setting instead of the one which would be the one applied (from the winning gpo)?.

Cheers,

0 comments

Answer 2

Thank you so much for your answer but I'm not really sure what do you mean exactly in point 6 when you say :

"and optionally /mergedpolicy if exporting from a custom DB with /db"

I want to dump live applied settings... for example :

Machine 1 has a local gpo
Machine 1 has appied another (for example) 3 active directory gpo at ou level or site or domain... or whatever....

The result of all that gpo after being applied, prioritized the corresponding way etc... is that SeDenyRemoteInteractiveLoginright has two users and a group. And for instance that SeInteractiveLoginright has 2 users.

I'm trying to see that with secedit. Am I doing it correctly if I do then :

secedit /export /areas user_rights /cfg C:\undirectorio\gpo.txt

Thank you!!!!!

Answer 3

Egoitz Aurrekoetxea 81

Sorry this was repeated and I don't really know how to remove it...

0 comments