How to Manage Local Security Policies in Batch Script

@echo off
setlocal

:: Check for admin rights
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Administrator privileges are required.
    pause
    exit /b 1
)

set "OUT_FILE=%TEMP%\security_audit.inf"

echo [PROCESS] Exporting local security policies to %OUT_FILE%...

secedit /export /cfg "%OUT_FILE%" /areas SECURITYPOLICY >nul

if %errorlevel% equ 0 (
    echo [SUCCESS] Policies exported successfully.
    echo [INFO] File: %OUT_FILE%
    echo [TIP] Open with Notepad to review settings.
) else (
    echo [ERROR] Export failed. Code: %errorlevel%
)
pause

@echo off
setlocal

:: Check for admin rights
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Administrator privileges are required.
    pause
    exit /b 1
)

set "POLICY_FILE=%TEMP%\lock_policy.inf"
set "TEMP_DB=%TEMP%\temp_secedit.sdb"

:: Create a Unicode INF file using PowerShell
:: (secedit requires UTF-16 LE encoding)
echo [PROCESS] Creating security policy template...
powershell -NoProfile -Command ^
    "[System.IO.File]::WriteAllText('%POLICY_FILE%', '[Unicode]`r`nUnicode=yes`r`n[System Access]`r`nLockoutBadCount = 5`r`n', [System.Text.Encoding]::Unicode)"

echo [PROCESS] Applying revised security policy...

:: Use a temporary database to avoid corrupting the main security database
secedit /configure /db "%TEMP_DB%" /cfg "%POLICY_FILE%" /areas SECURITYPOLICY

if %errorlevel% equ 0 (
    echo [SUCCESS] Account lockout policy applied (5 attempts^).
) else (
    echo [ERROR] Policy application failed. Code: %errorlevel%
)

:: Clean up temporary files
del "%POLICY_FILE%" >nul 2>&1
del "%TEMP_DB%" >nul 2>&1
del "%TEMP_DB%.log" >nul 2>&1
del "%TEMP_DB%.jfm" >nul 2>&1

pause

@echo off
:: Note: This requires ntrights.exe to be in the script's folder or PATH
set "USER=MyServiceAccount"

where ntrights >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] ntrights.exe not found. This tool is from the Windows Resource Kit.
    echo [HELP] As an alternative, use secedit or PowerShell to manage user rights.
    pause
    exit /b 1
)

echo [PROCESS] Granting 'Log on as a service' to %USER%...

ntrights -u "%USER%" +r SeServiceLogonRight

if %errorlevel% equ 0 (
    echo [SUCCESS] Right granted to %USER%.
) else (
    echo [ERROR] Failed to grant right. Code: %errorlevel%
)
pause

@echo off
setlocal

echo ============================================================
echo   Local Security Policy Manager
echo ============================================================

:: 1. Verify Admin Rights
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [CRITICAL] Administrator privileges are REQUIRED.
    pause
    exit /b 1
)

:: 2. Backup Current Config
set "BACKUP_FILE=%TEMP%\security_backup_%date:~-4%%date:~-10,2%%date:~-7,2%.inf"
echo.
echo [1/2] Backing up current settings...
secedit /export /cfg "%BACKUP_FILE%" /areas SECURITYPOLICY >nul

if %errorlevel% neq 0 (
    echo   [FAIL] Backup failed. Aborting for safety.
    pause
    exit /b 1
)
echo   [PASS] Backup saved: %BACKUP_FILE%

:: 3. Refresh/Re-apply existing DB (to fix configuration drift)
echo.
echo [2/2] Refreshing local security database...
secedit /configure /db "%windir%\security\local.sdb" /cfg "%windir%\inf\defltbase.inf" /areas SECURITYPOLICY >nul

if %errorlevel% equ 0 (
    echo   [PASS] Security database refreshed.
) else (
    echo   [WARN] Refresh encountered issues. Code: %errorlevel%
    echo   [HELP] Review the backup file and verify via secpol.msc.
)

echo.
echo [SUCCESS] System policies refreshed and backed up.
echo ============================================================
pause

echo [System Access] > config.inf
:: This creates an ANSI file, which secedit may reject or interpret incorrectly.