Greta Mameniskyte IV course 3rd group Local Security Policy Greta Mameniskyte IV course 3rd group

Table of contents Definition How to open Local Security Policy settings Account policies Local policies LSA Policy Objects How to use LSA Objects

Definition The Local Security Authority (LSA) is a protected subsystem of Windows that maintains information about all aspects of local security on a system, collectively known as the local security policy of the system. In other words, the local security policy of a system is a set of information about the security of a local computer. The local security policy information includes the following: The domains trusted to authenticate logon attempts. Which user accounts may access the system and how. For example, interactively, through a network, or as a service. The rights and privileges assigned to accounts. The security auditing policy. The Local Security Authority (LSA) stores the local policy information in a set of LSA Policy Objects.

How to open local security policy settings Windows+r -> secpol.msc Control panel -> Administrative tools -> Local Security Policy

Local security policies Account policies Password Policy Account Lockout Policy Local policies Audit Policy User Rights Assignment Security Options

Password policies Enforce password history Maximum password age Minimum password age Minimum password length Password must meet complexity requirements Store password using reversable encryption Enforce password history This security setting determines the number of unique new passwords that have to be associated with a user account before an old password can be reused. Maximum password age This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it. Minimum password age This security setting determines the period of time (in days) that a password must be used before the user can change it. Password must meet complexity requirements This security setting determines whether passwords must meet complexity requirements. Store password using reversable encryption This security setting determines whether the operating system stores passwords using reversible encryption. This policy provides support for applications that use protocols that require knowledge of the user's password for authentication purposes. Storing passwords using reversible encryption is essentially the same as storing plaintext versions of the passwords. For this reason, this policy should never be enabled unless application requirements outweigh the need to protect password information.

Account lockout policy Account lockout duration This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked. Account lockout threshold This security setting determines the number of failed logon attempts that causes a user account to be locked out. Reset account lockout counter after This security setting determines the number of minutes that must elapse after a failed logon attempt before the failed logon attempt counter is reset to 0 bad logon attempts.

Audit policies Audit policies records certain events that occur on your computer. Later you can go to the Event Viewer and see all the information about the events that have been set to be audited.

User Rights Assignment

User Rights Assignment

Security options

Security options

LSA Policy Objects The LSA stores local security policy information in a set of objects. Your application can query or edit the local security policy by accessing these objects. The set consists of the following four objects: Policy contains global policy information. TrustedDomain contains information about a trusted domain. Account contains information about a user, group, or local group account. Private Data contains protected information, such as server account passwords. This information is stored as encrypted strings

Using LSA Policy Opening a Policy Object Handle Managing Policy Information Receiving Policy Change Events Managing Account Permissions Managing Trusted Domain Information Translating Between Names and SIDs Storing Private Data Using LSA Unicode Strings

Opening a Policy Object Handle Most LSA Policy functions require a handle to the Policy object for the system to query or modify. To obtain a handle to a Policy object, call LsaOpenPolicy and specify the name of the system you want to access and the set of access permissions required.

Managing Policy Information To retrieve information about the local security policy, call LsaQueryInformationPolicy. To set local security policy, call LsaSetInformationPolicy. The description of the POLICY_INFORMATION_CLASS enumeration details the types of policy information that can be queried or set.

Receiving Policy Change Events (1) To receive notification, create a new event object by calling the CreateEvent function, and then call the LsaRegisterPolicyChangeNotification function.

Receiving Policy Change Events (2) When your application no longer needs to receive notifications, it should call LsaUnregisterPolicyChangeNotification and then call CloseHandle to free the event object handle.

Managing Account Permissions (1) To access all accounts that have a particular permission, call LsaEnumerateAccountsWithUserRight. This function populates an array with the SIDs (security Identifiers) of all accounts that have the specified permission.

Managing Account Permissions (2) After you have obtained the SID of an account, you can modify its permissions. Call LsaAddAccountRights to add permissions to the account. If the specified account does not exist, LsaAddAccountRights creates it. To remove permissions from an account, call LsaRemoveAccountRights. If you remove all permissions from an account, LsaRemoveAccountRights also deletes the account.

Managing Account Permissions (3) Your application can check the permissions currently assigned to an account by calling LsaEnumerateAccountRights. This function populates an array of LSA_UNICODE_STRING structures. Each structure contains the name of a privilege held by the specified account.

Managing Trusted Domain Information (1) You can enumerate the trusted domains by calling LsaEnumerateTrustedDomainsEx. To retrieve information about a trusted domain, call either LsaQueryTrustedDomainInfo or LsaQueryTrustedDomainInfoByName. Both functions return the same information; however, LsaQueryTrustedDomainInfo identifies the trusted domain by SID, and LsaQueryTrustedDomainInfoByName identifies the trusted domain by name.

Managing Trusted Domain Information (2) To set information for a trusted domain, call either LsaSetTrustedDomainInformation or LsaSetTrustedDomainInfoByName. As with the query functions, LsaSetTrustedDomainInformation identifies the trusted domain by SID, while LsaSetTrustedDomainInfoByName identifies the trusted domain by name.

Translating Between Names and SIDs To locate account names, call the LsaLookupNames function. This function returns the SID as a RID/Domain index pair. To get the SID as a single element, call the LsaLookupNames2 function. To locate SIDs, call LsaLookupSids.

Storing Private Data Call the LsaStorePrivateData function to store and encrypt private data. To retrieve and decode previously stored private data, call LsaRetrievePrivateData. Note that you cannot retrieve machine private data objects; machine objects can be retrieved only by the operating system.

Using LSA Unicode Strings Several of the LSA Policy functions use the LSA_UNICODE_STRING structure to store string information. This structure stores the string and its length information.

Sources of information https://docs.microsoft.com/en-us/windows/desktop/secmgmt/local-security-policy https://docs.microsoft.com/en-us/windows/desktop/secmgmt/using-lsa-policy https://docs.microsoft.com/en-us/windows/desktop/secmgmt/using-lsa-unicode-strings https://docs.microsoft.com/en-us/windows/desktop/secmgmt/opening-a-policy-object-handle https://docs.microsoft.com/en-us/windows/desktop/secmgmt/managing-policy-information https://docs.microsoft.com/en-us/windows/desktop/secmgmt/receiving-policy-change-events https://docs.microsoft.com/en-us/windows/desktop/secmgmt/managing-account-permissions https://docs.microsoft.com/en-us/windows/desktop/secmgmt/managing-trusted-domain- information https://docs.microsoft.com/en-us/windows/desktop/secmgmt/translating-between-names-and- sids https://docs.microsoft.com/en-us/windows/desktop/secmgmt/storing-private-data

Do you have any questions? Thank you! Do you have any questions?