SECEDIT

Windows Security Configuration, configure and analyze system security by comparing the current security configuration against a security template.

Syntax
   Analyze current systems settings against baseline settings that are stored in a database:
      SECEDIT /analyze /db database_filename [/cfg configuration_filename] [/overwrite]
         [/log log_filename] [/quiet}]

   Configure a system with security settings:
      SECEDIT /configure /db database_filename [/cfg configuration_filename] [/overwrite]
         [/areas [securitypolicy | group_mgmt | user_rights | regkeys | filestore | services]]
            [/log log_filename] [/quiet]

   Export security settings stored in a database:
      SECEDIT /export [/db database_filename] [/mergedpolicy] /cfg configuration_filename
         [/areas [securitypolicy | group_mgmt | user_rights | regkeys | filestore | services]]
            [/log log_filename] [/quiet]

   Import a security template into a database:
      SECEDIT /import /db database_filename /cfg configuration_filename [/overwrite]
         [/areas [securitypolicy | group_mgmt | user_rights | regkeys | filestore | services]]
            [/log log_filename] [/quiet]

   Generate a rollback template with respect to a configuration template:
      SECEDIT /generaterollback /db database_filename /cfg configuration_filename
         /rbk rollback_template_filename [/log log_filename] [/quiet]

   Validate the syntax of a security template:
      SECEDIT /validate configuration_filename

Key
   /db         The path and file name of the database containing the stored configuration
               against which the analysis or export is performed.
               Default is typically C:\windows\security\database\secedit.sdb 
               If the file name specifies a database that hasn't had a security template (as represented by the
               configuration file) associated with it, the /cfg configuration_filename option must also be specified.

   /cfg        The path and file name for the security template that will be imported into the database for analysis
               or exported when using the /export flag.
               If the /db database_filename parameter isn't also specified, the analysis will be performed against
               any configuration already stored in the database.

   /mergedpolicy
               Merge and export domain and local policy security settings.

   /overwrite  Whether the security template in the /cfg parameter should overwrite any template or composite template
               that is stored in the database, instead of appending the results to the stored template.
               This option is only valid when the /cfg configuration_filename parameter is also used.
               If this parameter isn't also specified, the template in the /cfg parameter is appended to the stored template.

   /areas      The security areas to be applied to the system.
               If this parameter is not specified, all security settings defined in the database are applied to the system.
               To configure multiple areas, separate each area by a space.

               Supported security areas:

                  securitypolicy : Local policy and domain policy for the system, including account policies, audit policies,
                                   security options, and so on.
                  group_mgmt  :  Restricted group settings for any groups specified in the security template.
                  user_rights :  User logon rights and granting of privileges.
                  regkeys     :  Security on local registry keys.
                  filestore   :  Security on local file storage.
                  services    :  Security for all defined services.

   /rbk 	   A security template into which the rollback information is written. Required for /generaterollback.
               Security templates are created using the Security Templates snap-in.
               Rollback files can be created with this command.

   /log        The path and file name of the log file to be used in the process.
               If you don't specify a file location, the default log file,
               systemroot\Documents and Settings\UserAccount\My Documents\Security\Logs\databasename.log is used.

   configuration_filename
               The path and file name for the security template that will be validated.
               Log files aren't updated by this command. Required for /validate.

   /quiet      Suppress screen output.
               You can still view analysis results by using the Security Configuration and Analysis snap-in to the
               Microsoft Management Console (MMC).

If no filepath is specified, all filenames will default to the current directory. Your analysis results are stored in a separate area of the database and can be viewed in the Security Configuration and Analysis snap-in to the MMC.

Running Secedit /configure is equivalent to making changes within the GUI snap-in SecPol.msc however if the policy editor is open when changes are made at the command line, you will need to close and reopen it to see the changes.

If your security templates are created by using the Security Template snap-in, and if you run the Security Configuration and Analysis snap-in against those templates, the following files are created:

File	Description
scesrv.log	Location: %windir%\security\logs Created by: Operating system File type: Text Refresh rate: Overwritten when secedit analyze, secedit configure, secedit export or secedit import is run. Content: Contains the results of the analysis grouped by policy type.
user-selected name.sdb	Location: %windir%\<user account>\Documents\Security\Database Created by: Running the Security Configuration and Analysis snap-in File type: Proprietary Refresh rate: Updated whenever a new security template is created. Content: Local security policies and user-created security templates.
user-selected name.log	Location: User-defined, but defaults to %windir%\<user account>\Documents\Security\Logs Created by: Running the secedit analyze or secedit configure commands, or by using the Security Configuration and Analysis snap-in. File type: Text Refresh rate: Overwritten when secedit analyze or secedit configure is run, or by using the Security Configuration and Analysis snap-in. Content: Log file name, date and time, and the results of the analysis or investigation.
user-selected name.inf	Location: %windir%\*<user account>\Documents\Security\Templates Created by: Running the Security Template snap-in. File type: Text Refresh rate: Overwritten each time the security template is updated. Content: Contains the set up information for the template for each policy selected using the snap-in.

Examples

Perform the analysis for the security parameters on the security database, SecDbSS64.sdb, and then direct the output to the file logSS64, including prompts to verify the command ran correctly:

C:\> secedit /analyze /db C:\demo\SecDbSS64.sdb /log C:\demo\logSS64.log

To incorporate changes required by the analysis process on the SS64.inf file, and then to direct the output to the existing file, logSS64, without prompting:

C:\> secedit /analyze /db C:\demo\SecDbSS64.sdb /cfg SS64.inf /overwrite /log C:\demo\logSS64.xml /quiet

Verify System Compliance, compare your current system settings against a predefined security template to see where the vulnerabilities are

C:\> secedit /analyze /db %temp%\temp.sdb /cfg "C:\Templates\SecureConfig.inf" /log C:\demo\analysis_results.log

To incorporate changes required by the analysis process on the SS64.inf file, and then to direct the output to the existing file, logSS64, without prompting:

C:\> secedit /configure /db C:\demo\SecDbSS64.sdb /cfg SS64.inf /overwrite /log C:\demo\logSS64.xml /quiet

Export Current Policy to a Readable File,
( /db is not specified in this example, so it will likely default to C:\windows\security\database\secedit.sdb):

C:\> secedit /export /cfg C:\demo\current_policy.inf

To export the security database and the domain security policies to an inf file. This file can later be imported to a different database in order to replicate the security policy settings on another computer:

C:\> secedit /export /db C:\windows\security\database\secedit.sdb /mergedpolicy /cfg C:\demo\SS64.inf /log C:\demo\logSS64.log /quiet

To import the example file to a different database on another computer:

C:\> secedit /import /db C:\demo\SecDbSS64.sdb /cfg C:\toimport\SS64.inf /log C:\demo\logSS64.log /quiet

To configure/apply the example file to a different database on another computer:

C:\> secedit /configure /db secedit.sdb /cfg C:\toimport\SS64.inf /overwrite

Create a rollback configuration file, for the previously created SecTmplSS64.inf file, while saving the original settings, and then write out the action to the logSS64 log file:

C:\> secedit /generaterollback /db C:\demo\SecDbSS64.sdb /cfg sectmplSS64.inf /rbk sectmplSS64RBK.inf /log C:\demo\logSS64.log

Export the security database and the domain security policies to an .inf file, and then to import that file to a different database to replicate the policy settings on another computer:

C:\> secedit /export /db C:\demo\SecDbSS64.sdb /mergedpolicy /cfg NetworkShare\Policies\SS64.inf /log C:\demo\logSS64.log /quiet

Import just the security policies portion of the file to a different database on another computer:

C:\> secedit /import /db C:\demo\SecDbContoso.sdb /cfg NetworkShare\Policies\SS64.inf /areas securitypolicy /log C:\demo\logSS64.log /quiet

Reset Security Settings to Defaults, if a machine has been overly hardened or misconfigured, you can reset the security descriptors to the original Windows installation state using the defltbase.inf file:

C:\> secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose /areas SECURITYPOLICY

or in PowerShell:

PS C:> secedit /configure /cfg $Env:WINDIR\inf\defltbase.inf /db defltbase.sdb /verbose /areas SECURITYPOLICY

“Security is mostly a superstition. It does not exist in nature, nor do the children of men as a whole experience it. Avoiding danger is no safer in the long run than outright exposure. Life is either a daring adventure, or nothing” ~ Helen Keller, The Open Door (1957)

Related commands

Parse-SecPol and Set-SecPol - A Pair of functions to read/write Policy files (SO).
AccessChk -L - Get the SDDL representing an object’s current security descriptor (Sysinternals).
SetObjectSecurity - Set security for an object (file, directory, reg key etc).

---