Windows上使用Python给用户增加或删除安全策略
在使用Python在 Windows 平台上开发的时候, 有时候我们需要动态增加或删除用户的某些访问策略, 此时我们可以通过LsaAddAccountRights 和LsaRemoveAccountRights API来实现。
比如，我们要给用户分配SE_SERVICE_LOGON_NAME安全策略
try:
user = 'admin'
policy_handle = win32security.LsaOpenPolicy(None, win32security.POLICY_ALL_ACCESS)
sid, domain, account_type = win32security.LookupAccountName(None, user)
win32security.LsaAddAccountRights(policy_handle, sid, (win32security.SE_SERVICE_LOGON_NAME,))
win32security.LsaClose(policy_handle)
except pywintypes.error as e:
print e
如果需要删除用户的的某个安全策略
try:
user = 'admin'
policy_handle = win32security.LsaOpenPolicy(None, win32security.POLICY_ALL_ACCESS)
sid, domain, account_type = win32security.LookupAccountName(None, user)
win32security.LsaRemoveAccountRights(policy_handle, sid, False, (win32security.SE_SERVICE_LOGON_NAME,))
win32security.LsaClose(policy_handle)
except pywintypes.error as e:
print e
最后看看查询用户安全策略
try:
user = 'admin'
policy_handle = win32security.LsaOpenPolicy(None, win32security.POLICY_ALL_ACCESS)
sid, domain, account_type = win32security.LookupAccountName(None, user)
print win32security.LsaEnumerateAccountRights(policy_handle, sid)
win32security.LsaClose(policy_handle)
except pywintypes.error as e:
print e
-
对于查询API，LsaEnumerateAccountRights API返回的是这个用户拥有的Policy tuple
，但是这里有一点需要注意，当用户没有任何Policy的时候，LsaEnumerateAccountRights API返回的并不是一个空的tuple，而是会抛出一个pywintypes.error错误，如下：
(2, 'LsaEnumerateAccountRights', 'The system cannot find the file specified.')
