Microsoft KB Archive/918451

= The Gpttmpl.inf file may reference built-in groups by their names instead of by their security identifiers on a Windows XP-based client computer =

Article ID: 918451

Article Last Modified on 5/26/2006

-

APPLIES TO


 * Microsoft Windows XP Professional
 * Microsoft Windows XP Home Edition

-





SYMPTOMS
Consider the following scenario. You update the User Rights Assignment security policy of a domain Group Policy object (GPO) on a Microsoft Windows XP-based client computer. The resulting Gpttmpl.inf file contains the security settings of the GPO. In this scenario, the Gpttmpl.inf file may reference built-in groups by their names instead of by their security identifiers (SIDs) in the Privilege Rights section.

When you install the Multilingual User Interface Pack (MUI) on the client computer, some of the built-in group names are translated to the local language of the client computer.

This behavior occurs even after you install the hotfix that is mentioned in the following Knowledge Base article.

329816 Cannot apply policies that are edited with a computer running Multilingual User Interface Pack

When you apply the domain GPO on some client computers, the following event may be logged in the Application log: Event Type: Warning

Event Source: SceCli

Event Category: None

Event ID: 1202

Date:

Time:

User: N/A

Computer:

Description: Security policies are propagated with warning. 0x534 : No mapping between account names and security IDs was done. Please look for more details in TroubleShooting section in Security Help.



CAUSE
This behavior occurs because the built-in groups are not listed in the domain database or in the client computer database. Therefore, the object picker of the client computer does not resolve the built-in groups to SIDs.



STATUS
This behavior is by design.



MORE INFORMATION
To avoid this behavior, we recommend that you change policies only when you work on a domain controller locally or by using Terminal Services.

