Previous
Next
I had the same issue. This has been resolved by installing each VM from scratch (not by cloning the VHD file which I've done earlier)
-st
>>>>>>>>>>>> the same storage based virtual xen server environment. I can add the
>>>>>>>>>>>> domain user to the local admin groups on one of the windows 2008
>>>>>>>>>>>> member server (this member server is also virtual machine on the same
>>>>>>>>>>>> storage), but the domain user doesn't show up in the local admin group
>>>>>>>>>>>> window and because of that this domain user doesn't have admin rights
>>>>>>>>>>>> on the local server, trying to readding gain to the local admin group
>>>>>>>>>>>> says "this user is already member of this group", any
>>>>>>>>>>>> ideas?
>>>>>>>>>>>> assistance, typed
>>>>>>>>>>>> as
>>>>>>>>>>>> >
>>>>>>>>>>>> >
>>>>>>>>>>>> > FYI, I tried and could not reproduce the issue in a classroom
>>>>>>>>>>>> environment.
-st
> On Wednesday, December 10, 2008 6:54 PM DangerMau wrote:
> I have two Windows Server 2008 servers. One is a DC and the other is a member
> server. I created a global security group in AD and tried to add it as a
> member of the local Administrators group of the member server. I am able to
> add it but if I open it back up the group is not listed. I have tried to
> other tests and if I click Apply instead of OK the domain group\user
> disappears instantly.
> If I try to add the same domain group\user it says that they are already
> members once I click OK\Apply.
> Any Ideas?
> -dm
> server. I created a global security group in AD and tried to add it as a
> member of the local Administrators group of the member server. I am able to
> add it but if I open it back up the group is not listed. I have tried to
> other tests and if I click Apply instead of OK the domain group\user
> disappears instantly.
> If I try to add the same domain group\user it says that they are already
> members once I click OK\Apply.
> Any Ideas?
> -dm
>> On Wednesday, December 10, 2008 7:15 PM DangerMau wrote:
>> More info:
>> I am running these both as Virtual Machines in Virtual Server 2005 R2 SP1.
>> They are both differencing disks built from the same parent disk (the parent
>> is a base install of Server 2008). I sysprepped the member server before
>> joining it to the domain.
>> I have since added a third member server (built from same parent disk and
>> sysprepped as well) with the same results. I tried doing it with a Vista
>> member server and had no problem.
>>
>> -dm
>>
>> "DangerMaus" wrote:
>> I am running these both as Virtual Machines in Virtual Server 2005 R2 SP1.
>> They are both differencing disks built from the same parent disk (the parent
>> is a base install of Server 2008). I sysprepped the member server before
>> joining it to the domain.
>> I have since added a third member server (built from same parent disk and
>> sysprepped as well) with the same results. I tried doing it with a Vista
>> member server and had no problem.
>>
>> -dm
>>
>> "DangerMaus" wrote:
>>> On Wednesday, December 10, 2008 8:52 PM Richard Mueller [MVP] wrote:
>>> "DangerMaus" <DangerMaus@discussions.microsoft.com> wrote in message
>>> news:C0916F75-6C98-48D7-8D18-FDA19FC1DC74@microsoft.com...
>>>
>>> Restricted Groups in Group Policy can enforce the membership in local
>>> Administrators groups. It sounds like this is happening to you. There are
>>> several kb articles on this, such as:
>>>
>>> http://technet.microsoft.com/en-us/library/cc756802.aspx
>>>
>>> --
>>> Richard Mueller
>>> MVP Directory Services
>>> Hilltop Lab - http://www.rlmueller.net
>>> --
>>> news:C0916F75-6C98-48D7-8D18-FDA19FC1DC74@microsoft.com...
>>>
>>> Restricted Groups in Group Policy can enforce the membership in local
>>> Administrators groups. It sounds like this is happening to you. There are
>>> several kb articles on this, such as:
>>>
>>> http://technet.microsoft.com/en-us/library/cc756802.aspx
>>>
>>> --
>>> Richard Mueller
>>> MVP Directory Services
>>> Hilltop Lab - http://www.rlmueller.net
>>> --
>>>> On Wednesday, December 10, 2008 9:17 PM Jorge Silva wrote:
>>>> Hi
>>>> can you describe the exact steps?
>>>>
>>>> --
>>>> I hope that the information above helps you.
>>>> Have a Nice day.
>>>>
>>>> Jorge Silva
>>>> MCSE, MVP Directory Services
>>>>
>>>> Please no e-mails, any questions should be posted in the NewsGroup
>>>> This posting is provided "AS IS" with no warranties, and confers no rights.
>>>>
>>>>
>>>> "DangerMaus" <DangerMaus@discussions.microsoft.com> wrote in message
>>>> news:C0916F75-6C98-48D7-8D18-FDA19FC1DC74@microsoft.com...
>>>> can you describe the exact steps?
>>>>
>>>> --
>>>> I hope that the information above helps you.
>>>> Have a Nice day.
>>>>
>>>> Jorge Silva
>>>> MCSE, MVP Directory Services
>>>>
>>>> Please no e-mails, any questions should be posted in the NewsGroup
>>>> This posting is provided "AS IS" with no warranties, and confers no rights.
>>>>
>>>>
>>>> "DangerMaus" <DangerMaus@discussions.microsoft.com> wrote in message
>>>> news:C0916F75-6C98-48D7-8D18-FDA19FC1DC74@microsoft.com...
>>>>> On Wednesday, December 10, 2008 9:54 PM DangerMau wrote:
>>>>> This is a fresh install with no custom setting in AD. I checked and I did not
>>>>> see any Restricted Groups configured in the default domain policy.
>>>>>
>>>>> -dm
>>>>>
>>>>> "Richard Mueller [MVP]" wrote:
>>>>> see any Restricted Groups configured in the default domain policy.
>>>>>
>>>>> -dm
>>>>>
>>>>> "Richard Mueller [MVP]" wrote:
>>>>>> On Wednesday, December 10, 2008 9:59 PM DangerMau wrote:
>>>>>> So I have a default install of Server 2008 with ADDS role added (using 2008
>>>>>> functional level). The Windows 2008 member server is a default install as
>>>>>> well.
>>>>>> On the DC, I create a global security group in AD, create a new user and add
>>>>>> it to that group.
>>>>>> On the member server, I open Server Manager, expand Local Users and Group,
>>>>>> open the properties of the local Administrators group, and add the Group from
>>>>>> AD.
>>>>>> If I immediately click OK and then open the properties of the local
>>>>>> administrators group it does not list the AD group I added.
>>>>>> I have rebooted by VMs and checked the group membership after an hour or
>>>>>> more just in case and still no group.
>>>>>> Now if I try to add the group again it will let me, but once I click OK it
>>>>>> will then say that the AD group is already a member of the local
>>>>>> Administrators group.
>>>>>> I think that is it but let me know if you need more info.
>>>>>> -dm
>>>>>>
>>>>>> "Jorge Silva" wrote:
>>>>>> functional level). The Windows 2008 member server is a default install as
>>>>>> well.
>>>>>> On the DC, I create a global security group in AD, create a new user and add
>>>>>> it to that group.
>>>>>> On the member server, I open Server Manager, expand Local Users and Group,
>>>>>> open the properties of the local Administrators group, and add the Group from
>>>>>> AD.
>>>>>> If I immediately click OK and then open the properties of the local
>>>>>> administrators group it does not list the AD group I added.
>>>>>> I have rebooted by VMs and checked the group membership after an hour or
>>>>>> more just in case and still no group.
>>>>>> Now if I try to add the group again it will let me, but once I click OK it
>>>>>> will then say that the AD group is already a member of the local
>>>>>> Administrators group.
>>>>>> I think that is it but let me know if you need more info.
>>>>>> -dm
>>>>>>
>>>>>> "Jorge Silva" wrote:
>>>>>>> On Thursday, December 11, 2008 1:45 AM Ace Fekay [Microsoft Certified Trainer] wrote:
>>>>>>> In news:63FC5CB7-FD00-469A-939F-42D0156BE0C6@microsoft.com,
>>>>>>> DangerMaus <DangerMaus@discussions.microsoft.com> requesting assistance,
>>>>>>> typed the following:
>>>>>>>
>>>>>>> Curious, what functional mode is the domain in?
>>>>>>>
>>>>>>> --??
>>>>>>> Ace
>>>>>>>
>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>> confers no rights.
>>>>>>>
>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>> Microsoft Certified Trainer
>>>>>>>
>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>> numbers.
>>>>>>> DangerMaus <DangerMaus@discussions.microsoft.com> requesting assistance,
>>>>>>> typed the following:
>>>>>>>
>>>>>>> Curious, what functional mode is the domain in?
>>>>>>>
>>>>>>> --??
>>>>>>> Ace
>>>>>>>
>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>> confers no rights.
>>>>>>>
>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>> Microsoft Certified Trainer
>>>>>>>
>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>> numbers.
>>>>>>>> On Thursday, December 11, 2008 11:18 AM DangerMau wrote:
>>>>>>>> Functional level is Server 2008.
>>>>>>>>
>>>>>>>> -dm
>>>>>>>>
>>>>>>>> "Ace Fekay [Microsoft Certified Trainer]" wrote:
>>>>>>>>
>>>>>>>> -dm
>>>>>>>>
>>>>>>>> "Ace Fekay [Microsoft Certified Trainer]" wrote:
>>>>>>>>> On Thursday, December 11, 2008 1:47 PM Jorge Silva wrote:
>>>>>>>>> Ok, can you try to remove that member server from the domain and re-add it
>>>>>>>>> again? then test.
>>>>>>>>> Also check if you have errors in eventvwr.
>>>>>>>>>
>>>>>>>>> --
>>>>>>>>> I hope that the information above helps you.
>>>>>>>>> Have a Nice day.
>>>>>>>>>
>>>>>>>>> Jorge Silva
>>>>>>>>> MCSE, MVP Directory Services
>>>>>>>>>
>>>>>>>>> Please no e-mails, any questions should be posted in the NewsGroup
>>>>>>>>> This posting is provided "AS IS" with no warranties, and confers no rights.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> "DangerMaus" <DangerMaus@discussions.microsoft.com> wrote in message
>>>>>>>>> news:63FC5CB7-FD00-469A-939F-42D0156BE0C6@microsoft.com...
>>>>>>>>> again? then test.
>>>>>>>>> Also check if you have errors in eventvwr.
>>>>>>>>>
>>>>>>>>> --
>>>>>>>>> I hope that the information above helps you.
>>>>>>>>> Have a Nice day.
>>>>>>>>>
>>>>>>>>> Jorge Silva
>>>>>>>>> MCSE, MVP Directory Services
>>>>>>>>>
>>>>>>>>> Please no e-mails, any questions should be posted in the NewsGroup
>>>>>>>>> This posting is provided "AS IS" with no warranties, and confers no rights.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> "DangerMaus" <DangerMaus@discussions.microsoft.com> wrote in message
>>>>>>>>> news:63FC5CB7-FD00-469A-939F-42D0156BE0C6@microsoft.com...
>>>>>>>>>> On Friday, December 12, 2008 4:32 PM mike172 wrote:
>>>>>>>>>> is a member
>>>>>>>>>> as a
>>>>>>>>>> able to
>>>>>>>>>> tried to
>>>>>>>>>> group\user
>>>>>>>>>> already
>>>>>>>>>>
>>>>>>>>>> Maybe this has something to do with licensing issue? Not
>>>>>>>>>> enough client access license maybe?
>>>>>>>>>> as a
>>>>>>>>>> able to
>>>>>>>>>> tried to
>>>>>>>>>> group\user
>>>>>>>>>> already
>>>>>>>>>>
>>>>>>>>>> Maybe this has something to do with licensing issue? Not
>>>>>>>>>> enough client access license maybe?
>>>>>>>>>>> On Thursday, December 18, 2008 12:54 PM mike172 wrote:
>>>>>>>>>>> installing all the servers separately not using the clones, looks
>>>>>>>>>>> like this is the issue with virtual environment.
>>>>>>>>>>> is a member
>>>>>>>>>>> as a
>>>>>>>>>>> able to
>>>>>>>>>>> tried to
>>>>>>>>>>> group\user
>>>>>>>>>>> already
>>>>>>>>>>> like this is the issue with virtual environment.
>>>>>>>>>>> is a member
>>>>>>>>>>> as a
>>>>>>>>>>> able to
>>>>>>>>>>> tried to
>>>>>>>>>>> group\user
>>>>>>>>>>> already
>>>>>>>>>>>> On Thursday, December 18, 2008 12:54 PM mike172 wrote:
>>>>>>>>>>>> > > I am having the same issue. 2 DC with 2008 functional level on
>>>>>>>>>>>> domain user to the local admin groups on one of the windows 2008
>>>>>>>>>>>> member server (this member server is also virtual machine on the same
>>>>>>>>>>>> storage), but the domain user doesn't show up in the local admin group
>>>>>>>>>>>> window and because of that this domain user doesn't have admin rights
>>>>>>>>>>>> on the local server, trying to readding gain to the local admin group
>>>>>>>>>>>> says "this user is already member of this group", any
>>>>>>>>>>>> ideas?
>>>>>>>>>>>> > >
>>>>>>>>>>>> > >
>>>>>>>>>>>> > >
>>>>>>>>>>>> > > In news:ff16fb66104eb8cb299260e82fa6@msnews.microsoft.com,
>>>>>>>>>>>> > > Meinolf Weber [MVP-DS] <meiweb(nospam)@gmx.de> requesting
>>>>>>>>>>>> > >
>>>>>>>>>>>> > >
>>>>>>>>>>>> > > In news:ff16fb66104eb8cb299260e82fa6@msnews.microsoft.com,
>>>>>>>>>>>> > > Meinolf Weber [MVP-DS] <meiweb(nospam)@gmx.de> requesting
>>>>>>>>>>>> > > the following:
>>>>>>>>>>>> > > Hello DangerMaus,
>>>>>>>>>>>> > >
>>>>>>>>>>>> > > If i follow your steps i can not reproduce your problem. It works
>>>>>>>>>>>> > > Hello DangerMaus,
>>>>>>>>>>>> > >
>>>>>>>>>>>> > > If i follow your steps i can not reproduce your problem. It works
>>>>>>>>>>>> > > expected in my test domain. Functional level is also 2008.
>>>>>>>>>>>> > >
>>>>>>>>>>>> > >
>>>>>>>>>>>> > Ace Fekay [Microsoft Cert wrote:>>>>>>>>>>>> > >
>>>>>>>>>>>> > >
>>>>>>>>>>>> >
>>>>>>>>>>>> >
>>>>>>>>>>>> > FYI, I tried and could not reproduce the issue in a classroom
>>>>>>>>>>>> > Functional level also 2008.
>>>>>>>>>>>> >
>>>>>>>>>>>> > Ace
>>>>>>>>>>>> >
>>>>>>>>>>>> > Ace
>>>>>>>>>>>>> On Wednesday, December 24, 2008 9:52 AM Ace Fekay [Microsoft Certified Trainer] wrote:
>>>>>>>>>>>>> In news:uaWdnT6FhovEE9fUnZ2dnUVZ_rmdnZ2d@giganews.com,
>>>>>>>>>>>>> mike1610 <mike1720@yahoo-dot-com.no-spam.invalid> requesting assistance,
>>>>>>>>>>>>> typed the following:
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> Clones? Did you sysprep the machines first or simply added a clone with
>>>>>>>>>>>>> identical SIDs? Sysprep will force the installation to create a brand new
>>>>>>>>>>>>> SID for all components that have a SID associated to it's identity. If not,
>>>>>>>>>>>>> I can see why this may be happening and why I cannot reproduce it.
>>>>>>>>>>>>>
>>>>>>>>>>>>> --?
>>>>>>>>>>>>> Ace
>>>>>>>>>>>>>
>>>>>>>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>>>>>>>> confers no rights.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>>>>>>>> Microsoft Certified Trainer
>>>>>>>>>>>>>
>>>>>>>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>>>>>>>> numbers.
>>>>>>>>>>>>> mike1610 <mike1720@yahoo-dot-com.no-spam.invalid> requesting assistance,
>>>>>>>>>>>>> typed the following:
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> Clones? Did you sysprep the machines first or simply added a clone with
>>>>>>>>>>>>> identical SIDs? Sysprep will force the installation to create a brand new
>>>>>>>>>>>>> SID for all components that have a SID associated to it's identity. If not,
>>>>>>>>>>>>> I can see why this may be happening and why I cannot reproduce it.
>>>>>>>>>>>>>
>>>>>>>>>>>>> --?
>>>>>>>>>>>>> Ace
>>>>>>>>>>>>>
>>>>>>>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>>>>>>>> confers no rights.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>>>>>>>> Microsoft Certified Trainer
>>>>>>>>>>>>>
>>>>>>>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>>>>>>>> numbers.
>>>>>>>>>>>>>> On Thursday, October 15, 2009 6:37 PM Guillermo Taylor wrote:
>>>>>>>>>>>>>> Hello all. I have the same issue and I do sysprepped the VMs. My VMs are TechNet licenced, BTW. If you guys have any ideas or workaround on what can be happening, please advise.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> I will try to create a VM from scratch and add it to the domain and see if the same behavior happens; I will let you know.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Thanks,
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Guillermo
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay [Microsoft Certified Trainer] wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> 24-Dec-08
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> mike1610 <mike1720@yahoo-dot-com.no-spam.invalid> requesting assistance,
>>>>>>>>>>>>>> typed the following:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Clones? Did you sysprep the machines first or simply added a clone with
>>>>>>>>>>>>>> identical SIDs? Sysprep will force the installation to create a brand new
>>>>>>>>>>>>>> SID for all components that have a SID associated to it is identity. If not,
>>>>>>>>>>>>>> I can see why this may be happening and why I cannot reproduce it.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --?
>>>>>>>>>>>>>> Ace
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>>>>>>>>> confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>>>>>>>>> Microsoft Certified Trainer
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>>>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>>>>>>>>> numbers.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Previous Posts In This Thread:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Add domain user\group to local admin group problem
>>>>>>>>>>>>>> I have two Windows Server 2008 servers. One is a DC and the other is a member
>>>>>>>>>>>>>> server. I created a global security group in AD and tried to add it as a
>>>>>>>>>>>>>> member of the local Administrators group of the member server. I am able to
>>>>>>>>>>>>>> add it but if I open it back up the group is not listed. I have tried to
>>>>>>>>>>>>>> other tests and if I click Apply instead of OK the domain group\user
>>>>>>>>>>>>>> disappears instantly.
>>>>>>>>>>>>>> If I try to add the same domain group\user it says that they are already
>>>>>>>>>>>>>> members once I click OK\Apply.
>>>>>>>>>>>>>> Any Ideas?
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> RE: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> More info:
>>>>>>>>>>>>>> I am running these both as Virtual Machines in Virtual Server 2005 R2 SP1.
>>>>>>>>>>>>>> They are both differencing disks built from the same parent disk (the parent
>>>>>>>>>>>>>> is a base install of Server 2008). I sysprepped the member server before
>>>>>>>>>>>>>> joining it to the domain.
>>>>>>>>>>>>>> I have since added a third member server (built from same parent disk and
>>>>>>>>>>>>>> sysprepped as well) with the same results. I tried doing it with a Vista
>>>>>>>>>>>>>> member server and had no problem.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> "DangerMaus" wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Richard Mueller [MVP] wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Restricted Groups in Group Policy can enforce the membership in local
>>>>>>>>>>>>>> Administrators groups. It sounds like this is happening to you. There are
>>>>>>>>>>>>>> several kb articles on this, such as:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> http://technet.microsoft.com/en-us/library/cc756802.aspx
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --
>>>>>>>>>>>>>> Richard Mueller
>>>>>>>>>>>>>> MVP Directory Services
>>>>>>>>>>>>>> Hilltop Lab - http://www.rlmueller.net
>>>>>>>>>>>>>> --
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Jorge Silva wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> Hi
>>>>>>>>>>>>>> can you describe the exact steps?
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --
>>>>>>>>>>>>>> I hope that the information above helps you.
>>>>>>>>>>>>>> Have a Nice day.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Jorge Silva
>>>>>>>>>>>>>> MCSE, MVP Directory Services
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Please no e-mails, any questions should be posted in the NewsGroup
>>>>>>>>>>>>>> This posting is provided "AS IS" with no warranties, and confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> This is a fresh install with no custom setting in AD. I checked and I did not
>>>>>>>>>>>>>> see any Restricted Groups configured in the default domain policy.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> "Richard Mueller [MVP]" wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> So I have a default install of Server 2008 with ADDS role added (using 2008
>>>>>>>>>>>>>> functional level). The Windows 2008 member server is a default install as
>>>>>>>>>>>>>> well.
>>>>>>>>>>>>>> On the DC, I create a global security group in AD, create a new user and add
>>>>>>>>>>>>>> it to that group.
>>>>>>>>>>>>>> On the member server, I open Server Manager, expand Local Users and Group,
>>>>>>>>>>>>>> open the properties of the local Administrators group, and add the Group from
>>>>>>>>>>>>>> AD.
>>>>>>>>>>>>>> If I immediately click OK and then open the properties of the local
>>>>>>>>>>>>>> administrators group it does not list the AD group I added.
>>>>>>>>>>>>>> I have rebooted by VMs and checked the group membership after an hour or
>>>>>>>>>>>>>> more just in case and still no group.
>>>>>>>>>>>>>> Now if I try to add the group again it will let me, but once I click OK it
>>>>>>>>>>>>>> will then say that the AD group is already a member of the local
>>>>>>>>>>>>>> Administrators group.
>>>>>>>>>>>>>> I think that is it but let me know if you need more info.
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> "Jorge Silva" wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay [Microsoft Certified Trainer] wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> typed the following:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Curious, what functional mode is the domain in?
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --??
>>>>>>>>>>>>>> Ace
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>>>>>>>>> confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>>>>>>>>> Microsoft Certified Trainer
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>>>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>>>>>>>>> numbers.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> Functional level is Server 2008.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> "Ace Fekay [Microsoft Certified Trainer]" wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Jorge Silva wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> Ok, can you try to remove that member server from the domain and re-add it
>>>>>>>>>>>>>> again? then test.
>>>>>>>>>>>>>> Also check if you have errors in eventvwr.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --
>>>>>>>>>>>>>> I hope that the information above helps you.
>>>>>>>>>>>>>> Have a Nice day.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Jorge Silva
>>>>>>>>>>>>>> MCSE, MVP Directory Services
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Please no e-mails, any questions should be posted in the NewsGroup
>>>>>>>>>>>>>> This posting is provided "AS IS" with no warranties, and confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> mike172 wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> is a member
>>>>>>>>>>>>>> as a
>>>>>>>>>>>>>> able to
>>>>>>>>>>>>>> tried to
>>>>>>>>>>>>>> group\user
>>>>>>>>>>>>>> already
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Maybe this has something to do with licensing issue? Not
>>>>>>>>>>>>>> enough client access license maybe?
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> mike172 wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> the same storage based virtual xen server environment. I can add the
>>>>>>>>>>>>>> domain user to the local admin groups on one of the windows 2008
>>>>>>>>>>>>>> member server (this member server is also virtual machine on the same
>>>>>>>>>>>>>> storage), but the domain user does not show up in the local admin group
>>>>>>>>>>>>>> window and because of that this domain user does not have admin rights
>>>>>>>>>>>>>> on the local server, trying to readding gain to the local admin group
>>>>>>>>>>>>>> says "this user is already member of this group", any
>>>>>>>>>>>>>> ideas?
>>>>>>>>>>>>>> assistance, typed
>>>>>>>>>>>>>> as
>>>>>>>>>>>>>> environment.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> mike172 wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> installing all the servers separately not using the clones, looks
>>>>>>>>>>>>>> like this is the issue with virtual environment.
>>>>>>>>>>>>>> is a member
>>>>>>>>>>>>>> as a
>>>>>>>>>>>>>> able to
>>>>>>>>>>>>>> tried to
>>>>>>>>>>>>>> group\user
>>>>>>>>>>>>>> already
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay [Microsoft Certified Trainer] wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> mike1610 <mike1720@yahoo-dot-com.no-spam.invalid> requesting assistance,
>>>>>>>>>>>>>> typed the following:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Clones? Did you sysprep the machines first or simply added a clone with
>>>>>>>>>>>>>> identical SIDs? Sysprep will force the installation to create a brand new
>>>>>>>>>>>>>> SID for all components that have a SID associated to it is identity. If not,
>>>>>>>>>>>>>> I can see why this may be happening and why I cannot reproduce it.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --?
>>>>>>>>>>>>>> Ace
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>>>>>>>>> confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>>>>>>>>> Microsoft Certified Trainer
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>>>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>>>>>>>>> numbers.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> EggHeadCafe - Software Developer Portal of Choice
>>>>>>>>>>>>>> .NET Web Services - Exception Handling And Non-Exception Error Handling
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> I will try to create a VM from scratch and add it to the domain and see if the same behavior happens; I will let you know.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Thanks,
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Guillermo
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay [Microsoft Certified Trainer] wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> 24-Dec-08
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> mike1610 <mike1720@yahoo-dot-com.no-spam.invalid> requesting assistance,
>>>>>>>>>>>>>> typed the following:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Clones? Did you sysprep the machines first or simply added a clone with
>>>>>>>>>>>>>> identical SIDs? Sysprep will force the installation to create a brand new
>>>>>>>>>>>>>> SID for all components that have a SID associated to it is identity. If not,
>>>>>>>>>>>>>> I can see why this may be happening and why I cannot reproduce it.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --?
>>>>>>>>>>>>>> Ace
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>>>>>>>>> confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>>>>>>>>> Microsoft Certified Trainer
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>>>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>>>>>>>>> numbers.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Previous Posts In This Thread:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Add domain user\group to local admin group problem
>>>>>>>>>>>>>> I have two Windows Server 2008 servers. One is a DC and the other is a member
>>>>>>>>>>>>>> server. I created a global security group in AD and tried to add it as a
>>>>>>>>>>>>>> member of the local Administrators group of the member server. I am able to
>>>>>>>>>>>>>> add it but if I open it back up the group is not listed. I have tried to
>>>>>>>>>>>>>> other tests and if I click Apply instead of OK the domain group\user
>>>>>>>>>>>>>> disappears instantly.
>>>>>>>>>>>>>> If I try to add the same domain group\user it says that they are already
>>>>>>>>>>>>>> members once I click OK\Apply.
>>>>>>>>>>>>>> Any Ideas?
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> RE: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> More info:
>>>>>>>>>>>>>> I am running these both as Virtual Machines in Virtual Server 2005 R2 SP1.
>>>>>>>>>>>>>> They are both differencing disks built from the same parent disk (the parent
>>>>>>>>>>>>>> is a base install of Server 2008). I sysprepped the member server before
>>>>>>>>>>>>>> joining it to the domain.
>>>>>>>>>>>>>> I have since added a third member server (built from same parent disk and
>>>>>>>>>>>>>> sysprepped as well) with the same results. I tried doing it with a Vista
>>>>>>>>>>>>>> member server and had no problem.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> "DangerMaus" wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Richard Mueller [MVP] wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Restricted Groups in Group Policy can enforce the membership in local
>>>>>>>>>>>>>> Administrators groups. It sounds like this is happening to you. There are
>>>>>>>>>>>>>> several kb articles on this, such as:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> http://technet.microsoft.com/en-us/library/cc756802.aspx
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --
>>>>>>>>>>>>>> Richard Mueller
>>>>>>>>>>>>>> MVP Directory Services
>>>>>>>>>>>>>> Hilltop Lab - http://www.rlmueller.net
>>>>>>>>>>>>>> --
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Jorge Silva wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> Hi
>>>>>>>>>>>>>> can you describe the exact steps?
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --
>>>>>>>>>>>>>> I hope that the information above helps you.
>>>>>>>>>>>>>> Have a Nice day.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Jorge Silva
>>>>>>>>>>>>>> MCSE, MVP Directory Services
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Please no e-mails, any questions should be posted in the NewsGroup
>>>>>>>>>>>>>> This posting is provided "AS IS" with no warranties, and confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> This is a fresh install with no custom setting in AD. I checked and I did not
>>>>>>>>>>>>>> see any Restricted Groups configured in the default domain policy.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> "Richard Mueller [MVP]" wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> So I have a default install of Server 2008 with ADDS role added (using 2008
>>>>>>>>>>>>>> functional level). The Windows 2008 member server is a default install as
>>>>>>>>>>>>>> well.
>>>>>>>>>>>>>> On the DC, I create a global security group in AD, create a new user and add
>>>>>>>>>>>>>> it to that group.
>>>>>>>>>>>>>> On the member server, I open Server Manager, expand Local Users and Group,
>>>>>>>>>>>>>> open the properties of the local Administrators group, and add the Group from
>>>>>>>>>>>>>> AD.
>>>>>>>>>>>>>> If I immediately click OK and then open the properties of the local
>>>>>>>>>>>>>> administrators group it does not list the AD group I added.
>>>>>>>>>>>>>> I have rebooted by VMs and checked the group membership after an hour or
>>>>>>>>>>>>>> more just in case and still no group.
>>>>>>>>>>>>>> Now if I try to add the group again it will let me, but once I click OK it
>>>>>>>>>>>>>> will then say that the AD group is already a member of the local
>>>>>>>>>>>>>> Administrators group.
>>>>>>>>>>>>>> I think that is it but let me know if you need more info.
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> "Jorge Silva" wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay [Microsoft Certified Trainer] wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> typed the following:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Curious, what functional mode is the domain in?
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --??
>>>>>>>>>>>>>> Ace
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>>>>>>>>> confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>>>>>>>>> Microsoft Certified Trainer
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>>>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>>>>>>>>> numbers.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> DangerMau wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> Functional level is Server 2008.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> -dm
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> "Ace Fekay [Microsoft Certified Trainer]" wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Jorge Silva wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain user\group to local admin group problem
>>>>>>>>>>>>>> Ok, can you try to remove that member server from the domain and re-add it
>>>>>>>>>>>>>> again? then test.
>>>>>>>>>>>>>> Also check if you have errors in eventvwr.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --
>>>>>>>>>>>>>> I hope that the information above helps you.
>>>>>>>>>>>>>> Have a Nice day.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Jorge Silva
>>>>>>>>>>>>>> MCSE, MVP Directory Services
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Please no e-mails, any questions should be posted in the NewsGroup
>>>>>>>>>>>>>> This posting is provided "AS IS" with no warranties, and confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> mike172 wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> is a member
>>>>>>>>>>>>>> as a
>>>>>>>>>>>>>> able to
>>>>>>>>>>>>>> tried to
>>>>>>>>>>>>>> group\user
>>>>>>>>>>>>>> already
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Maybe this has something to do with licensing issue? Not
>>>>>>>>>>>>>> enough client access license maybe?
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> mike172 wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> the same storage based virtual xen server environment. I can add the
>>>>>>>>>>>>>> domain user to the local admin groups on one of the windows 2008
>>>>>>>>>>>>>> member server (this member server is also virtual machine on the same
>>>>>>>>>>>>>> storage), but the domain user does not show up in the local admin group
>>>>>>>>>>>>>> window and because of that this domain user does not have admin rights
>>>>>>>>>>>>>> on the local server, trying to readding gain to the local admin group
>>>>>>>>>>>>>> says "this user is already member of this group", any
>>>>>>>>>>>>>> ideas?
>>>>>>>>>>>>>> assistance, typed
>>>>>>>>>>>>>> as
>>>>>>>>>>>>>> environment.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> mike172 wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> installing all the servers separately not using the clones, looks
>>>>>>>>>>>>>> like this is the issue with virtual environment.
>>>>>>>>>>>>>> is a member
>>>>>>>>>>>>>> as a
>>>>>>>>>>>>>> able to
>>>>>>>>>>>>>> tried to
>>>>>>>>>>>>>> group\user
>>>>>>>>>>>>>> already
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay [Microsoft Certified Trainer] wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Re: Add domain usergroup to local admin group problem
>>>>>>>>>>>>>> mike1610 <mike1720@yahoo-dot-com.no-spam.invalid> requesting assistance,
>>>>>>>>>>>>>> typed the following:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Clones? Did you sysprep the machines first or simply added a clone with
>>>>>>>>>>>>>> identical SIDs? Sysprep will force the installation to create a brand new
>>>>>>>>>>>>>> SID for all components that have a SID associated to it is identity. If not,
>>>>>>>>>>>>>> I can see why this may be happening and why I cannot reproduce it.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> --?
>>>>>>>>>>>>>> Ace
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>>>>>>>>>>>>> confers no rights.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
>>>>>>>>>>>>>> Microsoft Certified Trainer
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>>>>>>>>>>>>> Please check http://support.microsoft.com for regional support phone
>>>>>>>>>>>>>> numbers.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> EggHeadCafe - Software Developer Portal of Choice
>>>>>>>>>>>>>> .NET Web Services - Exception Handling And Non-Exception Error Handling
>>>>>>>>>>>>>> Submitted via EggHeadCafe
>>>>>>>>>>>>>> ASP.NET 4.0 browser capabilities
>>>>>>>>>>>>>> http://www.eggheadcafe.com/tutorials/aspnet/668c15e2-9fe5-4a7a-94ac-001af0bf4d1b/aspnet-40-browser-capabilities.aspx
>>>>>>>>>>>>>> ASP.NET 4.0 browser capabilities
>>>>>>>>>>>>>> http://www.eggheadcafe.com/tutorials/aspnet/668c15e2-9fe5-4a7a-94ac-001af0bf4d1b/aspnet-40-browser-capabilities.aspx
| 09 Nov 2010 | Re: Same issue with VMs... | srikanth t |
Previous
Next