The system actually distinguishes between the privilege and its close cousin, the account right.

The Account rights are bind to an user account and normaly managed using the GUI secpol.msc on a computer. The other privileges are bind to a token process. The command

whoami /priv

will display both type of privileges


More info about Privileges can be found here:

    The privilege to adjust. This set is taken from

    pinvoke AdjustTokenPrivileges (advapi32)


There is no Powershell cmdlet or commandline tool to set these privileges as I know.

I run into an issue when using Set-ACL cmdlet to set NTFS Permissions in the past.

    if current Powershell Process do not have Token Privilege 'SeRestorePrivilege',
    which is not as default, we get an Error.
    'Set-ACL : The security identifier is not allowed to be the owner of this object.'

    The solution was to asign the Privilege 'SeRestorePrivilege' to the Powershell Process (Necessary to set Owner Permissions)


These was one reason to create an advanced function to be able to set Privileges for a Powershell Process or any Process.

To make the function easy in use I used the ValidateSet() statement for the Parameter -Privilege as you can see here there are many Privileges you can set :

    [Parameter(Position=0,Mandatory=$True,ValueFromPipeline=$False,HelpMessage='An Token Privilege.')]
        "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
        "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
        "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
        "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
        "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
        "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
        "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
        "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
        "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
        "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
        "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]


Now we can use Poweshell Intellisense to be able to select a Privilege of a list that is shown by Intellisense when you type the function and parameter Name '-Privileges'


    Set-LHSTokenPrivilege -Privilege SeRestorePrivilege

    To set the 'Restore Privilege' for the current Powershell Process.

    Set-LHSTokenPrivilege -Privilege SeRestorePrivilege -Disable

    To disable 'Restore Privilege' for the current Powershell Process.

    Set-LHSTokenPrivilege -Privilege SeShutdownPrivilege -ProcessId 4711
    To set the 'Shutdown Privilege' for the Process with Process ID 4711