Microsoft KB Archive/810076

= Updates to Restricted Groups (&quot;Member of&quot;) behavior of user-defined local groups =

Article ID: 810076

Article Last Modified on 2/1/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Home Edition
 * Microsoft Windows 2000 Service Pack 4
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Datacenter Server
 * Microsoft Windows 2000 Professional Edition

-





SUMMARY
In versions of Microsoft Windows earlier than Microsoft Windows 2000 Service Pack 4 (SP4), the Restricted Groups Member of security setting in Group Policy cannot be used to add domain groups to local groups on member computers. The Restricted Groups behavior was updated in Windows 2000 SP4 and in the Microsoft Windows Server 2003 family. Microsoft Windows XP Service Pack 1 (SP1) requires a hotfix to update the Restricted Groups behavior. This article describes the changes to the feature.



MORE INFORMATION
With the Restricted Groups Member of functionality, you can now add domain groups to local groups. For more information about the Restricted Groups feature, including Members and Member of descriptions, see &quot;Restricted Groups&quot; in the Windows Server product documentation.

Service pack information
To resolve this problem, obtain the latest service pack for Windows XP. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

322389 How to obtain the latest Windows XP service pack

Hotfix information
A supported feature that modifies the product's default behavior is now available from Microsoft, but it is only intended to modify the behavior that this article describes. Apply it only to systems that specifically require it. This feature may receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next Windows XP service pack that contains this feature.

To obtain this feature immediately, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

The English version of this feature has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.   Date         Time   Version        Size     File name   Platform 31-Jan-2003 02:53  5.1.2600.1163  849,408  Scesrv.dll  IA64 31-Jan-2003 02:53  5.1.2600.1163  307,712  Scesrv.dll  i386

Adding Domain Groups to Local Groups
After you have verified that the feature is installed on all appropriate computers, you can use the Restricted Groups Member of setting to add a domain group to a local group (built-in or custom). You can define Member of policies for distinct groups in multiple Group Policy objects (GPOs) that are linked to any site, any domain, or any organizational unit (OU), and all the policies take effect. For example, as illustrated in the following table, you can create a policy that adds Domain Admins to the local Administrators group, and you can add a policy that adds My Management Admins group to the local Administrators group. This group is linked to a domain-level GPO. You can also create a policy that adds the My Organizational Unit Regional Admins group to the local Administrators group. This group is linked to an OU-level GPO. All policies are enforced.

Table 1: Adding domain groups to local groups

Adding the same domain group to local groups across GPOs
If you create multiple Restricted Groups policies for the same group in multiple GPOs, only one policy will take effect. Restricted Groups policies for the same group do not merge across GPOs. The effective policy is determined by the order of the Group Policy processing. For information about Group Policy hierarchy and processing order, visit the following Microsoft Developer Network Web site:

http://msdn2.microsoft.com/en-us/library/aa374155.aspx

For example, as illustrated in the following table, two Restricted Group policies are defined for Domain Admins. One is defined at the domain level and adds Domain Admins to the local Administrators group. The other is defined at the OU level and adds the Domain Admins group to My Regional Division Admins. Domain Admins will only be added to My Regional Division Admins (by default, GPOs that are linked at the OU level override those that are defined at the domain level).

Table 2: Adding the same domain group to local groups across GPOs

Domain controllers
In earlier versions of Windows, if a domain controller processes a Restricted Groups policy in which the Members section is left blank, all members are purged from the group when the policy is applied, regardless of the setting for Member of. For example, if you create a Restricted Groups policy at the domain level for Domain Admins with a blank Members section and if you included local Administrators in Member of, when the policy is applied, all members of the Domain Admins group are removed (including the built-in Administrator account), and an empty Domain Admins group is added to the local administrators group.

The behavior in Windows 2000 SP4, Windows XP with Service Pack 2 (SP2), and Windows Server 2003 has been corrected. On a computer that is running one of these versions of Windows, if you apply a Restricted Groups policy that defines Member of but leaves Members blank, the Members section is ignored, and group membership is not emptied.

If you plan to use the Restricted Groups functionality that is enabled by this update to configure domain controllers, member servers, or workstations, make sure that they are all running Windows 2000 SP4, Windows XP SP2, or Windows Server 2003 so that domain group membership is not modified unintentionally.

For member servers and workstations, the behavior in this scenario remains unchanged.

Applying &quot;Members&quot; and &quot;Member of&quot; Restricted Groups policies to a local group
It is best to define a Restricted Groups policy that adds a domain group to a local group and to define another Restricted Groups policy that restricts that local group’s membership. The final group membership of that local group cannot be predicted because the processing order of the two Restricted Groups policies is not defined. For example, as illustrated in the following table, if you create a Restricted Groups policy that adds Domain Admins to the local Administrators group and if you create a Restricted Groups policy that limits membership of the local Administrators group to the built-in Administrator account, you cannot predict if either policy will be enforced. If Domain Admins are added to the local Administrators group before the Administrators membership is limited, Domain Admins will be added to the local Administrators group and then removed. However, if the local Administrators group membership is limited before Domain Admins is added to the Administrators group, Domain Admins will remain in the local Administrators group.

Table 3: Adding a domain group to a local group with restricted membership

To get the membership that you want, use either Members or Member of Restricted Group policies exclusively. In the example in Table 3, to get the Administrators group membership that you want, add Domain Admins to the Members entry for the local Administrators group Restricted Groups policy.

Service pack information
To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to obtain the latest Windows 2000 service pack

Hotfix information
A supported feature that modifies the product's default behavior is now available from Microsoft, but it is only intended to modify the behavior that this article describes. Apply it only to systems that specifically require it. This feature may receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next Windows 2000 service pack that contains this feature.

To obtain this feature immediately, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

 Date       Time     Version         Size       File name - 07-Nov-2002 22:33   5.0.2195.6109    124,688   Adsldp.dll 07-Nov-2002 22:33   5.0.2195.5781    131,344   Adsldpc.dll 07-Nov-2002 22:33   5.0.2195.6109     62,736   Adsmsext.dll 07-Nov-2002 22:33   5.0.2195.6052    358,160   Advapi32.dll 07-Nov-2002 22:33   5.0.2195.6094     49,936   Browser.dll 07-Nov-2002 22:33   5.0.2195.6012    135,952   Dnsapi.dll 07-Nov-2002 22:33   5.0.2195.6076     96,016   Dnsrslvr.dll 15-Nov-2001 23:27                      5,149   Empty.cat 07-Nov-2002 22:33   5.0.2195.5722     45,328   Eventlog.dll 07-Nov-2002 22:33   5.0.2195.6059    146,704   Kdcsvc.dll 01-Nov-2002 18:52   5.0.2195.6112    204,048   Kerberos.dll 21-Aug-2002 16:27   5.0.2195.6023     71,248   Ksecdd.sys 07-Nov-2002 02:02   5.0.2195.6118    507,664   Lsasrv.dll 07-Nov-2002 02:02   5.0.2195.6118     33,552   Lsass.exe 27-Aug-2002 22:53   5.0.2195.6034    108,816   Msv1_0.dll 07-Nov-2002 22:33   5.0.2195.5979    307,472   Netapi32.dll 07-Nov-2002 22:33   5.0.2195.6075    360,720   Netlogon.dll 07-Nov-2002 22:33   5.0.2195.6100    920,848   Ntdsa.dll 07-Nov-2002 22:33   5.0.2195.6100    389,392   Samsrv.dll 07-Nov-2002 22:33   5.0.2195.6120    130,320   Scecli.dll 07-Nov-2002 22:33   5.0.2195.6120    303,888   Scesrv.dll 07-Nov-2002 01:56   5.0.2195.6118    139,264   Sp3res.dll 07-Nov-2002 00:05         5.3.9.0      4,096   Spmsg.dll 07-Nov-2002 00:06         5.3.9.0     87,040   Spuninst.exe 07-Nov-2002 22:33   5.0.2195.5859     48,912   W32time.dll 04-Jun-2002 21:32   5.0.2195.5859     57,104   W32tm.exe 07-Nov-2002 22:33   5.0.2195.6100    126,224   Wldap32.dll 07-Nov-2002 02:02   5.0.2195.6118    507,664   Lsasrv.dll     --   56-bit For more information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the following article number to view the article in the Microsoft Knowledge Base:

265173 The Datacenter Program and Windows 2000 Datacenter Server product

For more information about how to install multiple Windows updates or hotfixes while restarting only once, click the following article number to view the article in the Microsoft Knowledge Base:

296861 How to install multiple Windows updates or hotfixes with only one reboot

Keywords: kbfix kbwin2000presp4fix kbqfe kbsecurity kbwinxpsp2fix kbwin2ksp4fix kbhotfixserver KB810076

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.