Have you ever seen a way to address the LSA API in order to set/query rights? It doesn't look like you can do this with ADSI or anything else (besides the Local Security Policy MMC or ntrights.exe ResKit tool).