Microsoft KB Archive/887729

= Multiple entries for the same User Group account are displayed in the Virtual Server Security Properties page on the Virtual Server Administration Web site =

Article ID: 887729

Article Last Modified on 11/2/2007

-

APPLIES TO

 Microsoft Virtual Server 2005 Standard Edition, when used with:  Microsoft Windows Server 2003, Web Edition

 Microsoft Windows Server 2003, Standard Edition (32-bit x86)

 Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)

 Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)</li></ul>

 Microsoft Windows Server 2003, Enterprise x64 Edition</li></ul>

 Microsoft Windows Server 2003, 64-Bit Datacenter Edition</li></ul> </li></ul>

-

<div class="notice_section">

<div class="symptoms_section">

SYMPTOMS
When you view the Virtual Server security settings on Virtual Server Administration Web site that is running on a Windows Server 2003-based computer, you may see multiple permission entries for the following group accounts on the Virtual Server Security Properties Web page:
 * Administrators
 * Users
 * Power Users
 * Everyone

<div class="cause_section">

CAUSE
This behavior occurs when you enable the following option on the Security tab of the \Documents and Settings\All Users\ApplicationData\Microsoft\Virtual Server folder on your Windows Server 2003-based computer:

Inherit from parent the permissions entries that apply to child objects. Include these with entries explicitly defined here.

When a Virtual Server file is created by a member of a user group, the user group is given ownership of the file instead of the individual user account. When you enable the '''Inherit from parent the permissions entries that apply to child objects. Include these with entries explicitly defined here.''' option, an additional access control entry for the user group account is added.

By default, when you install Virtual Server 2005, the '''Inherit from parent the permissions entries that apply to child objects. Include these with entries explicitly defined here.''' option is not enabled.

<div class="workaround_section">

WORKAROUND
To work around this behavior, you must turn off the '''Inherit from parent the permissions entries that apply to child objects. Include these with entries explicitly defined here.''' option. To do this, follow these steps:
 * 1) Log on to the Windows Server 2003-based computer with an account that has administrative permissions.
 * 2) Using Windows Explorer, locate and right-click the \Documents and Settings\All Users\ApplicationData\Microsoft\Virtual Server folder, and then click Properties.
 * 3) In the Virtual Server Properties dialog box, click Security, and then click Advanced.
 * 4) In the Advanced Security Settings for Virtual Server dialog box, click to clear the Inherit from parent the permissions entries that apply to child objects. Include these with entries explicitly defined here. check box.
 * 5) In the Security dialog box, click Remove, click OK, and then click OK again.

<div class="status_section">

STATUS
This behavior is by design.

Keywords: kbtshoot kbprb KB887729

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.