Automating security configuration tasks

The Secedit.exe command line tool, when called from a batch file or automatic task scheduler, can be used to automatically create and apply templates and analyze system security. It can also be run dynamically from a command line.

This tool is useful when you have multiple computers on which security must be analyzed or configured, and need to perform these tasks off-hours.

  • For procedural information on using the Secedit.exe command line tool to perform security tasks, see How To...

For information on defining Security Templates, see Security Templates.

For more information on security configuration and analysis, see Security Configuration and Analysis.


How to ...

  • Analyze system security
  • Configure system security
  • Refresh security settings
  • Export security settings
  • Validate a security configuration file


Analyze system security

secedit /analyze

This command analyzes system security.

Syntax

secedit /analyze [/DB filename ] [/CFG filename ] [/log logpath] [/verbose] [/quiet]

Parameters

/DB filename
Provides the path to a database that contains the stored configuration against which the analysis will be performed. This is a required argument. If filename specifies a new database, the CFG filename argument must also be specified.
/CFG filename
This argument is only valid when used with the /DB parameter. It is the path to the security template that will be imported into the database for analysis. If this argument is not specified, the analysis is performed against any configuration already stored in the database.
/log logpath
The path to the log file for the process. If this is not provided, the default file is used.
/verbose
Requests more detailed progress information during the analysis.
/quiet
Suppresses screen and log output. You will still be able to view analysis results using Security Configuration and Analysis.

Related Topics


Configure system security

secedit /configure

This command configures system security by applying a stored template.

Syntax

secedit /configure [/DB filename ] [/CFG filename ] [/overwrite][/areas area1 area2...] [/log logpath] [/verbose] [/quiet]

Parameters

/DB filename
Provides the path to a database that contains the security template that should be applied. This is a required argument.
/CFG filename
This argument is only valid when used with the /DB parameter. It is the path to the security template that will be imported into the database and applied to the system. If this argument is not specified, the template already stored in the database will be applied.
/overwrite
This argument is only valid when the /CFG argument is also used. This specifies whether the security template in the /CFG argument should overwrite any template or composite template stored in the database instead of appending the results to the stored template. If this is not specified, the template in the /CFG argument will be appended to the stored template.
/areas area1 area2...
Specifies the security areas to be applied to the system. The default is "all areas." Each area should be separated by a space.
Area Name | Description
SECURITYPOLICY | Local policy and domain policy for the system, including account policies, audit policies, and so on.
GROUP_MGMT | Restricted group settings for any groups specified in the security template
USER_RIGHTS | User logon rights and granting of privileges
REGKEYS | Security on local registry keys
FILESTORE | Security on local file storage
SERVICES | Security for all defined services
/log logpath
Path to the log file for the process. If not specified, the default is used.
/verbose
Specifies more detailed progress information.
/quiet
Suppresses screen and log output.


Refresh security settings

secedit /refreshpolicy

This command refreshes system security by reapplying the security settings to the Group Policy object.

Syntax

secedit /refreshpolicy {machine_policy | user_policy}[/enforce]

Parameters

machine_policy
Refreshes security settings for the local computer.
user_policy
Refreshes security settings for the local user account currently logged on to the computer.
/enforce
Refreshes security settings, even if there have been no changes to the Group Policy object settings.


Export security settings

secedit /export

This command exports a stored template from a security database to a security template file.

Syntax

secedit /export [/mergedPolicy] [/DB filename ] [/CFG filename ] [/areas area1 area 2...] [/log logPath] [/verbose] [/quiet]

Parameters

/MergedPolicy
Merges and exports domain and local policy security settings.
/DB filename
Provides the path to a database that contains the template that will be exported. If a database is not provided, the system policy database is used.
/CFG filename
Path and name of a file where the template should be saved.
/areas area1 area2...
Specifies the security areas to be exported to a template. The default is "all areas." Each area should be separated by a space.
Area Name | Description
SECURITYPOLICY | Local policy and domain policy for the system, including account policies, audit policies, and so on.
GROUP_MGMT | Restricted group settings for any groups specified in the security template
USER_RIGHTS | User logon rights and granting of privileges
REGKEYS | Security on local registry keys
FILESTORE | Security on local file storage
SERVICES | Security for all defined services
/log logpath
Path to the log file for the process. If not specified, the default is used.
/verbose
Specifies more detailed progress information.
/quiet
Suppresses screen and log output.


Validate a security configuration file

secedit /validate

This command validates the syntax of a security template you want to import into a database for analysis or application to a system.

Syntax

secedit /validate filename

Parameters

filename
The file name of the security template you have created with Security Templates.