Lsa tool connects to the Local Security Authority on a remote Windows system and lets you translate account names to SIDs and back, enumerate LSA policy accounts and their privileges, create LSA accounts, and grant or revoke privileges and system access rights.
The LSA tracks accounts separately from the SAM. Even for local accounts, you may need to create an LSA policy account first with
createaccount before granting privileges.Subcommands
| Command | Description |
|---|---|
| whoami | Get the name and domain of the connected user |
| lookupname | Get the SID for one or more account names |
| lookupsid | Translate one or more SIDs to their account names |
| enumaccounts | Enumerate LSA policy accounts |
| enumprivaccounts | Enumerate accounts that have a specific privilege or user right |
| createaccount | Create an LSA policy account |
| getprivs | Get the privileges assigned to an account |
| getrights | Get the user rights and privileges granted to an account |
| getsysaccess | Get the system access rights granted to an account |
| setsysaccess | Set the system access rights granted to an account |
| addpriv | Add one or more privileges to an account |
| rmpriv | Remove one or more privileges from an account |
For help on any subcommand, run
Lsa <subcommand> -h.Common options
AllLsa subcommands share these authentication and connection options:
Authentication (credentials)
Authentication (credentials)
User name to authenticate with (not including the domain).
Domain of the authenticating user.
Password to authenticate with.
NTLM hash for pass-the-hash authentication.
Use anonymous login.
Authentication (Kerberos)
Authentication (Kerberos)
Connection
Connection
Override network address(es) of the server.
Use TCP over IPv4 only.
Use TCP over IPv6 only.
Encrypt RPC messages.
Connect over a named pipe instead of TCP when supported.
SOCKS5 proxy endpoint.
whoami
Returns the name and domain of the user account used to authenticate to the LSA.Parameters
Parameters
RPC server to interact with.
Options
Options
Fields to display. Available:
WireName, UserName, Realm, OriginalText, NameType, NamePartCount.Examples
lookupname
Translates one or more account names to their SIDs. Accepts multiple names in a single call.Parameters
Parameters
Options
Options
Fields to display. Available:
AccountName, NameType, DomainName, DomainSid, AccountRid, AccountSid.Examples
lookupsid
Translates one or more SIDs to their account names. Accepts multiple SIDs in a single call.Parameters
Parameters
Options
Options
Fields to display. Available:
AccountName, NameType, DomainName, DomainSid, AccountRid, AccountSid.Examples
enumaccounts
Enumerates accounts in the LSA policy database. By default returns only SIDs. Use-OutputFields to include account and domain names, which requires additional RPC calls.
Parameters
Parameters
RPC server to interact with.
Options
Options
Fields to display. Available:
Sid, AccountName, DomainName.Examples
enumprivaccounts
Enumerates accounts that hold a specific privilege or user right.Parameters
Parameters
RPC server to interact with.
Examples
createaccount
Creates an LSA policy account for the given SID. This is required before you can grant privileges or access rights to an account that doesn’t yet have an LSA entry.Examples
getprivs
Gets the privileges assigned to an account. Specify the account by SID (-BySid) or name (-ByName). One of these options is required.
By default, only the names of well-known privileges are resolved. To retrieve names for all privileges, add PrivilegeName to -OutputFields.
Parameters
Parameters
RPC server to interact with.
Examples
getrights
Gets all user rights and privileges granted to an account. Specify the account by SID (-BySid) or name (-ByName).
Parameters
Parameters
RPC server to interact with.
Examples
getsysaccess
Gets the system access rights granted to an account. Specify the account by SID (-BySid) or name (-ByName).
Parameters
Parameters
RPC server to interact with.
Examples
setsysaccess
Sets the system access rights granted to an account. By default, the specified rights are added to any already granted. Use-Reset to clear existing rights and grant only the rights specified. To remove all rights, use -Reset with 0.
System access rights include logon rights such as SeInteractiveLogonRight and SeServiceLogonRight.
Parameters
Parameters
RPC server to interact with.
Access rights to grant. Possible values:
SeInteractiveLogonRight, SeNetworkLogonRight, SeBatchLogonRight, SeServiceLogonRight, SeDenyInteractiveLogonRight, SeDenyNetworkLogonRight, SeDenyBatchLogonRight, SeDenyServiceLogonRight, SeRemoteInteractiveLogonRight, SeDenyRemoteInteractiveLogonRight.Examples
addpriv
Adds one or more privileges to an account. Specify the account by SID (-BySid) or name (-ByName).
Privilege names can be symbolic (e.g. SeLoadDriverPrivilege) or numeric 64-bit integers. For predefined privileges, you may omit the Privilege suffix (e.g. SeLoadDriver instead of SeLoadDriverPrivilege). If the name is not predefined, it is resolved with the remote LSA.
Parameters
Parameters
Examples
rmpriv
Removes one or more privileges from an account. To remove all privileges, specify* (escape as needed in your shell). Specify the account by SID (-BySid) or name (-ByName).
Parameters
Parameters