Modifying/detecting Local Security Policy programmatically

Question

Is it possible to do at least one of the following:

1) Detect a setting of a Local Security Policy (Accounts: Limit local account use of blank passwords to console logon only)

2) Modify that setting

Using Win32/MFC?

score 2 · Answer 1 · edited Feb 01 '13 at 13:59

2

I've been down this road before and ended up with:

I was able to configure User Rights Assignments using the Lsa* functions in advapi32.dll but could never work out how to configure Security Options.

This may be of help though:

You could customise a template then run regsvr32 %windir%\system32\scecli.dll from inside your code.

Not elegant but might be a way.

edited Feb 01 '13 at 13:59

rae1

answered Sep 25 '08 at 02:20

Kev

Thank you - I'll check them out, although I did look through Lsa* functions and haven't found what I need. – dennisV Sep 25 '08 at 02:38
Thanks - I'll probably just modify the registry key directly (prompting the user first to tell what's happening). – dennisV Sep 25 '08 at 03:52

score 2 · Answer 2 · answered Sep 25 '08 at 02:51

Well, I think I figured out how to do the first part (detecting this setting). It's actually located in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

the key is "LimitBlankPasswordUse", if it's 1 then it's Enabled, otherwise Disabled.

So, reading that will at least show me if I need to tell the user to modify it or not. I doubt I can change it though...

2 Answers2