Microsoft KB Archive/254255
Article ID: 254255
Article Last Modified on 2/28/2007
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional Edition
This article was previously published under Q254255
When you install a build of Windows 2000 earlier than Release Candidate 1 (RC1) on a clean computer and assign user rights to add a domain account or a trusted domain account, and then upgrade to Windows 2000 build 2151 or later, the user rights for the domain account are lost. Specifically, the service logon right is lost during the graphical user interface (GUI) mode setup.
To work around this behavior, wait for the next policy propagation when the correct user rights are automatically reassigned. Policy propagation takes place at the most 16 hours after setup.
You can also manually reassign the user rights by doing one of the following:
In the local security settings, change the data format manually and change any of the user rights. This saves all user rights in the new format.
Type the following at the command prompt:
secedit /refreshpolicy machine_policy /enforce
NOTE: This corrects the behavior only for this build. The problem will reoccur when you upgrade the operating system again.
User rights assigned to built-in accounts or local accounts do not exhibit this behavior. In addition, cleanly installed RC1 or post-RC1 builds of Windows 2000 do not exhibit this behavior.
Additional query words: win2krelnotes
Keywords: kbprb KB254255