Skip to main content

How to Import Local Security Policy Settings in Batch Script

Applying consistent security settings across multiple machines, such as password complexity rules, account lockout thresholds, and user rights assignments, is a cornerstone of IT administration. Rather than manually clicking through the secpol.msc GUI on every workstation, you can use a Batch script to "Import" a pre-configured security template. This is done using the secedit utility, which allows you to apply .inf templates to the local security database automatically. This guide explains how to deploy these policies at scale.

Why Import Local Security Policies?​

  • Workstation Standardization: Ensuring every computer in a lab, office, or kiosk has the exact same security "Hardening" applied.
  • Rapid Recovery: Restoring a known-good security state after a major system update or a troubleshooting session that required lowering defenses.
  • Automated Provisioning: Including a security template as part of a "Zero-Touch" OS installation or a new machine onboarding script.
The Secedit Utility

secedit.exe is the standard Windows command-line tool for managing the security configuration database (local.sdb). It supports importing, exporting, and verifying security settings.

Method: Importing and Applying a Policy Template (.inf)​

To import settings, you need a source .inf file (which you can generate using the "Export" method). You then "Configure" the local database using that file.

@echo off
setlocal

:: Check for admin rights
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Administrator privileges are required.
    pause
    exit /b 1
)

set "TEMPLATE=%~dp0StandardHardening.inf"

:: Verify the template exists
if not exist "%TEMPLATE%" (
    echo [ERROR] Template file not found: %TEMPLATE%
    pause
    exit /b 1
)

echo [PROCESS] Applying Security Policy from: %TEMPLATE%...

:: Use a temporary database to avoid corrupting the main security database
set "TEMP_DB=%TEMP%\secedit_import_%RANDOM%.sdb"

:: /configure = Apply settings
:: /db = Database file (using temp to protect local.sdb)
:: /cfg = Your template file
:: /areas SECURITYPOLICY = Targets account and local policies

secedit /configure /db "%TEMP_DB%" /cfg "%TEMPLATE%" /areas SECURITYPOLICY >nul

if %errorlevel% equ 0 (
    echo [SUCCESS] Security policies have been updated.
    echo [NOTE] Run 'gpupdate /force' to ensure changes take effect immediately.
) else (
    echo [ERROR] Configuration failed. Code: %errorlevel%
    echo [HELP] Check the log at: %windir%\security\logs\scesrv.log
    echo [HELP] Ensure the .inf file is UTF-16 LE encoded.
)

:: Clean up temporary database files
del "%TEMP_DB%" >nul 2>&1
del "%TEMP_DB%.log" >nul 2>&1
del "%TEMP_DB%.jfm" >nul 2>&1

pause

Creating a Deployment Wrapper for Multiple Areas​

A professional script backs up the current configuration, then applies both general security policies and specific "User Rights" in one operation.

@echo off
setlocal

echo ============================================================
echo   Security Configuration Deployment Engine
echo ============================================================

:: 1. Verify Administrative Rights (Mandatory)
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [CRITICAL] Admin rights REQUIRED for security modification.
    pause
    exit /b 1
)

:: 2. Check if template exists
set "TEMPLATE=%~dp0GlobalSecurity.inf"
if not exist "%TEMPLATE%" (
    echo [ERROR] Template not found: %TEMPLATE%
    pause
    exit /b 1
)

:: 3. Backup current configuration before overwriting
set "BACKUP_FILE=%~dp0SecurityBackup_%COMPUTERNAME%_%date:~-4%%date:~-10,2%%date:~-7,2%.inf"
echo [STEP 1/3] Backing up current security settings...
secedit /export /cfg "%BACKUP_FILE%" /areas SECURITYPOLICY USER_RIGHTS >nul

if %errorlevel% neq 0 (
    echo [ERROR] Backup failed. Aborting for safety.
    pause
    exit /b 1
)
echo   [PASS] Backup saved: %BACKUP_FILE%

:: 4. Apply Policy using a temporary database
set "TEMP_DB=%TEMP%\secedit_deploy_%RANDOM%.sdb"
echo.
echo [STEP 2/3] Merging template into local security database...
secedit /configure /db "%TEMP_DB%" /cfg "%TEMPLATE%" /areas SECURITYPOLICY USER_RIGHTS >nul

if %errorlevel% neq 0 (
    echo [ERROR] Policy application failed. Code: %errorlevel%
    echo [HELP] Check: %windir%\security\logs\scesrv.log
    echo [INFO] Your backup is at: %BACKUP_FILE%
    del "%TEMP_DB%" >nul 2>&1
    del "%TEMP_DB%.log" >nul 2>&1
    del "%TEMP_DB%.jfm" >nul 2>&1
    pause
    exit /b 1
)
echo   [PASS] Template applied successfully.

:: Clean up temporary database
del "%TEMP_DB%" >nul 2>&1
del "%TEMP_DB%.log" >nul 2>&1
del "%TEMP_DB%.jfm" >nul 2>&1

:: 5. Force a refresh
echo.
echo [STEP 3/3] Enforcing policy update...
gpupdate /force >nul

echo.
echo [SUCCESS] Security deployment complete.
echo ============================================================
pause

Common Pitfalls and How to Avoid Them​

Administrative Rights​

The secedit /configure command requires local Administrator privileges because it modifies the protected security database. Running it from a standard terminal will result in an "Access Denied" error.

Encoding Sensitivity​

Windows expects the .inf security templates to be in Unicode (UTF-16 LE) format.

Wrong Way:

:: Manually creating a .inf file in Notepad and saving it as "UTF-8"

Correct Way: Always use a template that was originally generated by secedit /export, or ensure your text editor is specifically set to save as "UTF-16 LE." If secedit returns "Task is completed with error," encoding is the most likely culprit.

SEO and UX Tip

Advise your users to check the log file produced by secedit (usually located in %windir%\security\logs\scesrv.log) if the command fails. This log provides the exact line number in the .inf file that caused the error.

Best Practices for Security Deployment​

  1. Backup Before Import: Always run an /export command to save the current state before you overwrite it with a new template.
  2. Combine with GPUpdate: After applying the policy with secedit, run gpupdate /force. This ensures the system instantly recognizes the new settings without needing a reboot.
  3. Validate After Applying: You can use secedit /validate or secedit /analyze to ensure your template doesn't contain syntax errors that could cause security gaps.
Domain-Joined Machines

Note that if a machine is part of a Domain, Active Directory Group Policies will overwrite your local imports every 90 minutes. This method is primarily intended for standalone servers, workgroups, or "Base Image" preparation.

Conclusion​

Importing local security policy settings via Batch script is a vital skill for maintaining high standards of system defense across your organization. By utilizing the secedit utility to deploy verified security templates, you can ensure that your configuration is consistent, documented, and resistant to manual error. This professional approach to system management simplifies machine provisioning, improves overall security posture, and provides a clear, automated mechanism for enforcing your organization's security standards across the entire Windows ecosystem.

Table of Contents