Windows本地安全策略的编程操作 [英] Programmatical manipulation of Windows Local Security Policy

问题描述

我正在寻找一种以编程方式访问和修改PC中本地组策略设置的方法.

I am looking for a method to access and modify local group policy settings in a PC programatically.

例如，如果我要检查/修改设置的值

For example, if I want to check / modify a value for a setting

计算机配置\ Windows设置\安全设置\本地策略\审核策略\审核登录事件"(取自gpedit的路径)，我应该能够通过命令行对其进行查询，或者在没有gpedit的情况下为其设置值或任何其他本机GUI界面.

"Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit Logon Events" (Path taken from gpedit), I should be able to query it over a command line or set a value to it without the gpedit or any other native GUI interface.

可能的方法是以下两种方法之一:-

Possible methods that I could think that might solve this problem were either of the following two:-

1..用于本地组策略设置操作的编程界面

1. A programming interface for Local Group Policy Setting manipulation

Based on my search 

i. There were no official documentation or tools from Microsoft that could query and manipulate a given setting in Local Security Policy. 

ii. The closest I could get was a vendor named sdmsoftware (Link:- https://sdmsoftware.com/group-policy-management-products/group-policy-automation-engine/) who provides a powershell interface for manipulating the Local group policy. Since the company I work is just a startup, we cant invest on any tools right now. Hence buying something is out of scope.I am looking for a freeware / OSS / any work-around to achive this.

2..一个映射文件，由映射到相应注册表项或文件路径的所有本地安全设置组成.这样，可以使用相同的注册表项或文件直接查询或修改安全设置.

2. A mapping file consisting of All Local Security Settings mapped to a corresponding registry key or a file path. So that the same registry keys or file can be used to directly query or modify a security setting.

Based on my search 

i. I found a list given by Microsoft which gives a corresponding  registry key to some of the Local Security Policy settings. However , the list does not contain mappings of all Local Security Settings.
(Link:- www . microsoft . com /en - us / download / details . aspx ? id=25250) 

我知道可以通过使用gpresult导出结果并对其进行解析来完成查询任务，但是修改是不可能的.我还尝试测试和分析以下Microsoft工具，以便通过监视PSmon之类的工具来查看各种打开的组策略设置的路径，以查看正在打开的文件和正在查询的注册表等.:-
a) (链接:-technet.microsoft.com/en-us/solutionaccelerators/cc835245.aspx)

I understand that the querying task can be done by exporting the result using gpresult and parsing it but however the same is not possible for modification. I also tried testing and analysing the following Microsoft Tools to somehow get the path of various local group policy settings by monitoring under tools like PSmon for seeing what files were being opened and what registries were being queried etc. :-
a) Security Compliance Manager (Link :-technet. microsoft . com / en-us / solutionaccelerators / cc835245 . aspx)

b) Microsoft安全合规性工具包 (链接:-www.microsoft.com/zh-cn/download/confirmation.aspx?id = 55319& 6B49FDFB-8E5B-4B07-BC31-15695C5A2143 = 1)

b) Microsoft Security Compliance Toolkit (Link :-www. microsoft. com / en-us / download/confirmation.aspx ? id=55319&6B49FDFB-8E5B-4B07-BC31-15695C5A2143=1)

但是，它没有产生任何结果，也可能是因为我可能没有正确分析它们.

However , it did not yield any result could also be becauase I might have not analysed them properly.

我想知道是否有用于本地安全策略的任何文档/文章/免费(免费啤酒中的免费)编程界面/可以使我以编程方式编辑和查询本地组设置的任何破解方法.

I would like to know if there are any documents / articles / a free ( free as in free beer) programming interface for Local Security policy / any work around hack that can allow me to edit and query local group settings programatically.

提前谢谢.

推荐答案

不幸的是，并非以相同的方式访问安全设置"中的每个设置.

Unfortunately not every setting in the Security Settings is accessible in the same way.

正如您已经说过的，您可以在注册表中设置大多数设置.如果不是，则在很大程度上取决于您要修改的设置.例如，您可以使用:

As you already said, you can set most settings in the registry. If not, it highly depends on the setting you want to modify. For instance you can use:

• auditpol.exe 用于审核策略设置.
>
• UserRights.ps1 用于用户权限分配

• auditpol.exe for Audit Policy Settings.
• UserRights.ps1 for User Right Assignments.

Afaik没有所有设置的解决方案.如果您需要修改其他设置，则应要求此特定设置，以找到针对该设置的编程方式解决方案.

Afaik there is no solution for all settings. If you need to modify another setting, you should ask for this specific setting, to find a programmatical way solution for it.

这篇关于Windows本地安全策略的编程操作的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！