SecEdit.exe

  • File Path: C:\WINDOWS\system32\SecEdit.exe
  • Description: Windows Security Configuration Editor Command Tool

Hashes

Type Hash
MD5 367B706DCAAAD0FEEC45B1B7EBC43FA5
SHA1 7631B195944FBC2C9864725A90034A8DDC9BDC15
SHA256 06AE5A23EAB781022BD2BE2D68075F1373121C703DA1BC664D18442E6DD44206
SHA384 8849233AD79787CA1EBF957070BB1FB71A55997A7A9877985019CED225EFFF96B0B8D345DBE2A651FBCA0C66D4A7A040
SHA512 695DF9BD096C7F9CA4ADB9D0E8E4B59B0109C780DB30960B8D512340397644F6787DD115C2E7B416E6750355C4B12E5456E7FB9A1FF63FAC5C821F156175FD3B
SSDEEP 768:l1z3sj5LoNPioVCmdAB9Rmwp0W6EKGAUKJqT7/pXk:lttgDmdi9RqLEKGAUB
IMP 58A66C69176097C9B8C5C9AE4273BD6F
PESHA1 07784482A5356E709082E1841B3D35BC75191C41
PE256 28B00A94FA068DC282B98575808DB09DFB02F6B63568D1D75913CE39977FA3D0

Runtime Data

Usage (stdout):


The syntax of this command is:

secedit [/configure | /analyze | /import | /export | /validate | /generaterollback]

Loaded Modules:

Path
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\system32\SecEdit.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: SeCEdit
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/06ae5a23eab781022bd2be2d68075f1373121c703da1bc664d18442e6dd44206/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\SecEdit.exe 35
C:\WINDOWS\system32\SecEdit.exe 32
C:\Windows\system32\SecEdit.exe 35
C:\windows\system32\SecEdit.exe 35
C:\Windows\system32\SecEdit.exe 32
C:\Windows\SysWOW64\SecEdit.exe 35
C:\WINDOWS\SysWOW64\SecEdit.exe 36
C:\windows\SysWOW64\SecEdit.exe 36
C:\WINDOWS\SysWOW64\SecEdit.exe 35
C:\Windows\SysWOW64\SecEdit.exe 33
C:\Windows\SysWOW64\SecEdit.exe 38

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

secedit commands

Configures and analyzes system security by comparing your current security configuration against specified security templates.

[!NOTE] The Microsoft Management Console (MMC) and the Security Configuration and Analysis snap-in are not available on Server Core.

Syntax

secedit /analyze
secedit /configure
secedit /export
secedit /generaterollback
secedit /import
secedit /validate

Parameters

Parameter Description
secedit /analyze Allows you to analyze current systems settings against baseline settings that are stored in a database. The analysis results are stored in a separate area of the database and can be viewed in the Security Configuration and Analysis snap-in.
secedit /configure Allows you to configure a system with security settings stored in a database.
secedit /export Allows you to export security settings stored in a database.
secedit /generaterollback Allows you to generate a rollback template with respect to a configuration template.
secedit /import Allows you to import a security template into a database so that the settings specified in the template can be applied to a system or analyzed against a system.
secedit /validate Allows you to validate the syntax of a security template.
Remarks

  • If there is no filepath specified, all filenames will default to the current directory.

  • Your analysis results are stored in a separate area of the database and can be viewed in the Security Configuration and Analysis snap-in to the MMC.

  • If your security templates are created by using the Security Template snap-in, and if you run the Security Configuration and Analysis snap-in against those templates, the following files are created:

    File Description
    scesrv.log <ul><li>Location: %windir%\security\logs</li><li>Created by: Operating system</li><li>File type: Text</li><li>Refresh rate: Overwritten when secedit analyze, secedit configure, secedit export or secedit import is run.</li><li>Content: Contains the results of the analysis grouped by policy type.</li></ul>
    user-selected name.sdb <ul><li>Location: %windir%\<user account>\Documents\Security\Database</li><li>Created by: Running the Security Configuration and Analysis snap-in</li><li>File type: Proprietary</li><li>Refresh rate: Updated whenever a new security template is created.</li><li>Content: Local security policies and user-created security templates.</li></ul>
    user-selected name.log <ul><li>Location: User-defined, but defaults to %windir%\<user account>\Documents\Security\Logs</li><li>Created by: Running the secedit analyze or secedit configure commands, or by using the Security Configuration and Analysis snap-in.</li><li>File type: Text</li><li>Refresh rate: Overwritten when secedit analyze or secedit configure is run, or by using the Security Configuration and Analysis snap-in.</li><li>Content: Log file name, date and time, and the results of the analysis or investigation.</li></ul>
    user-selected name.inf <ul><li>Location: %windir%\*<user account>\Documents\Security\Templates</li><li>Created by: Running the Security Template snap-in.</li><li>File type: Text</li><li>Refresh rate: Overwritten each time the security template is updated.</li><li>Content: Contains the set up information for the template for each policy selected using the snap-in.</li></ul>

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.