Can't add &amp;amp;amp;amp;amp;amp;quot;Administrators&amp;amp;amp;amp;amp;amp;quot;

10-17-2006, 03:44 AM

OK, I have been having issues with folder permissions on a Windows Server 2003 box which is a member of a domain (within a fairly substantial forest). Let's call the domain "dom.orgsn.net"

One of the problems I have is that (logged in as a Domain Admin of dom.orgsn.net), I find a folder which does not have "Administrators --> Full Control" on it. I try to correct it, however when I type "Administrators" in the "Select User, Computer or Group" dialog, I get the answer

"An object (User, Group, or built-in security proncipal) with the following name cannot be found: "administrators". Check the selected object types for accuracy and ensure you have typed the object name correctly, or remove this object from the selection."

In the "Object type" I have "User, group or built-in security principal" selected. In the "from this location" field I have "dom.orgsn.net" selected.

If I try to narrow the search down, by selecting "dom.orgsn.net\BuiltIn" as the location, and typing simply "A" as the object name, it returns a list of "Authenticated Users" and "Anonymous logon". No Administrators group. Looking in AD Users and Computers confirms that this group does actually exist.

***?!?! LOL

Please help?

crazijoe · 10-17-2006, 05:36 AM

Try "Domain Admin".

10-17-2006, 06:39 AM

That wasn't actually my question. I'm not a paper MCSE I'm a real one.

I want to know why I can't add BuiltIn\Administrators... in fact it seems to extend to all domain local groups; I can't give Domain Local Groups permissions to files...

crazijoe · 10-17-2006, 06:52 AM

Quote:

Originally Posted by stonelaughter

I'm not a paper MCSE I'm a real one.

What's your point.

10-17-2006, 08:21 AM

Quote:

Originally Posted by crazijoe

What's your point.

Just that I'm not dim; I do know about the Domain Admins group. That was not however what I was trying to accomplish. I saw your reply as patronising and possibly even contemptuous; either that or you assumed that I was not asking the question I wanted answered.

Have you any idea then, why I cannot add Domain Local Groups (including "Administrators") to a folder's permissions?

crazijoe · 10-17-2006, 08:38 AM

Builtin groups cannot be used the way you want. They are designed to be used on the domain controllers and the domain controllers only for delegation purposes.
You may need to create the DLGs for each of the domains under the users folder in AD. But as far as I know you cannot use BuiltIn groups in that manner.

whardman · 10-17-2006, 01:02 PM

If you are looking to add full DOMAIN administrator privileges on a computer/server that is not a domain controller then you must use "Domain Admins". "Administrator" is only available as a local group. If you want to add the local administrator then change the location to the local computer/server.

whardman · 10-17-2006, 01:08 PM

Quote:

Originally Posted by stonelaughter

That wasn't actually my question. I'm not a paper MCSE I'm a real one.

I want to know why I can't add BuiltIn\Administrators... in fact it seems to extend to all domain local groups; I can't give Domain Local Groups permissions to files...

This is impossible. You can only add local permissions on the local computer. You cannot add local permissions on a remote computer.

10-17-2006, 02:30 PM

Quote:

Originally Posted by whardman

This is impossible. You can only add local permissions on the local computer. You cannot add local permissions on a remote computer.

I have clearly made the distinction here between DOMAIN LOCAL and LOCAL.

I initially tried to add dom.orgsn.net\builtin\administrators to the ACL for a folder. It's clear from the above (thanks crazijoe) that this wouldn't work. However, I also tried to add dom.orgsn.net\dom groups\other group (whose scope is DOMAIN LOCAL) to the ACL for a folder. I could not even SEE the group, never mind add it to the ACL.

There are four scopes remember? Local (on an individual computer), DOMAIN LOCAL (visible only within the domain), Domain Global and Universal.

whardman · 10-18-2006, 07:59 AM

Quote:

Originally Posted by stonelaughter

There are four scopes remember? Local (on an individual computer), DOMAIN LOCAL (visible only within the domain), Domain Global and Universal.

WRONG! There are four scopes:
Local (on an individual computer)
DOMAIN LOCAL ( ONLY VISIBLE ON DOMAIN CONTROLLER(S))
Domain Global (Seen within the domain)
Universal (seen throughout the forest)

I have tested it!! You seem to have come to the same conclusion but don't seem to believe it.

10-18-2006, 08:38 AM

FFS - I'm gonna ask on a different forum I think...

See below from http://technet2.microsoft.com/Window....mspx?mfr=true

Quote:

When to use groups with domain local scope
Groups with domain local scope help you define and manage access to resources within a single domain. These groups can have as their members:

• Groups with global scope

• Groups with universal scope

• Accounts

• Other groups with domain local scope

• A mixture of any of the above

For example, to give five users access to a particular printer, you could add all five user accounts in the printer permissions list. If, however, you later want to give the five users access to a new printer, you would again have to specify all five accounts in the permissions list for the new printer.

With a little planning, you can simplify this routine administrative task by creating a group with domain local scope and assigning it permission to access the printer. Put the five user accounts in a group with global scope and add this group to the group having domain local scope. When you want to give the five users access to a new printer, assign the group with domain local scope permission to access the new printer. All members of the group with global scope automatically receive access to the new printer.

whardman · 10-18-2006, 03:39 PM

Quote:

Groups on client computers and stand-alone servers

Some group features, such as universal groups, group nesting, and the distinction between security groups and distribution groups, are available only on Active Directory domain controllers and member servers. Group accounts on Windows 2000 Professional, Windows XP Professional, Windows 2000 Server, and stand-alone servers running Windows Server 2003 work the same way as in Windows NT 4.0:

• Only local groups can be created locally on the computer.

• A local group created on one of these computers can be assigned permissions only on that one computer.

It can't access a local group on another computer either. If you can figure out how to do this let me know because it doesn't work for me either.

BTW, what mode is the domain in ... I have been assuming the default Windows 2000 mixed.

**bilbus** · 10-18-2006, 08:04 PM

sounds like somone needs to reread some of the test materials.

builtin local, is not the same as domain local

10-19-2006, 02:25 AM

Quote:

Originally Posted by whardman

I can't access a local group on another computer either. If you can figure out how to do this let me know because it doesn't work for me either.

BTW, what mode is the domain in ... I have been assuming the default Windows 2000 mixed.

FFS I am NOT TALKING ABOUT LOCAL GROUPS!!!

The domain/forest are in Native/Windows Server 2003 Mode.

**** you lot I'm leaving - you're not listening to a ******* word I say.

**Horse** · 10-19-2006, 03:32 AM

Quote:

FFS - I'm gonna ask on a different forum I think...

Quote:

FFS I am NOT TALKING ABOUT LOCAL GROUPS!!!

Quote:

**** you lot I'm leaving - you're not listening to a ******* word I say.

Perhaps that would be the best route for you since you have taken to having tantrums and bad mouthing people who are offering their advice in good faith in their attempt to help you. The fact you are getting frustrated, is not an excuse for bad behaviour. Control your emotions or follow you own advice and go to a different forum before I ban you from this one.

**Cellus** · 10-19-2006, 09:04 AM

If the folder you are trying to reference is outside the DC, such as on a separate file server, then referencing the Built-in Domain Locals will not work. Built-in DLs should be considered to be the same thing as Built-in Local groups, except that since DCs share databases, they refer to all the DCs (but only the DCs) in that domain. Built-in Domain Locals and regular Domain Locals are actually two different beasts of the same species.

NoPaperMCSE · 11-06-2007, 11:23 AM

Stonelaughter -

I feel your frustration. I found this forums site because I was experiencing the exact same issue you described in your posts. As I was following this thread I found myself getting frustrated with everyone's inability to grasp the essence of this simple question. This is the prime example of why MSFT exams take such heated criticism - too easy to acquire the certification without knowing the material.

Anyway, I found the answer to 'our' question - http://support.microsoft.com/kb/279835

Quote:

SYMPTOMS
Administrators are unable to assign Group Policy settings to domain local groups from a Microsoft Windows 2000 member server or a Windows 2000 Professional computer in a Windows 2000 native-mode domain.

NOTE: This behavior only occurs from computers that are not domain controllers. Domain controllers can successfully view and apply policies to domain local groups.

CAUSE
This behavior can occur if the domain local groups are not listed in the list of groups to which specific policies apply.
Back to the top

RESOLUTION
To resolve this behavior, use one of the following steps:

• Assign the Group Policy while you manually access the domain controller.
-Or-
• Install Terminal Services on one of the domain controllers (Remote Administration mode is sufficient). Use a Terminal Services client to access the domain controller and modify the Group Policy appropriately.

Horse -

Give the guy a break. He's trying to find a resolution to his problem on a "technical" forum and the only support he's getting is from those who have no clue what they are talking about. His frustration is based on the fact that he's already explained the difference between Local Groups and Domain Local Groups, which should have been clearly understood from the very first post. If you don't understand the difference between these two groups, you need to go back and study the MSFT MCSE material again.

10-17-2006, 03:44 AM	#1 (permalink)
stonelaughter Guest Posts: n/a OS:	Can't add &amp;amp;amp;amp;amp;amp;quot;Administrators&amp;amp;amp;amp;amp;amp;quot; OK, I have been having issues with folder permissions on a Windows Server 2003 box which is a member of a domain (within a fairly substantial forest). Let's call the domain "dom.orgsn.net" One of the problems I have is that (logged in as a Domain Admin of dom.orgsn.net), I find a folder which does not have "Administrators --> Full Control" on it. I try to correct it, however when I type "Administrators" in the "Select User, Computer or Group" dialog, I get the answer "An object (User, Group, or built-in security proncipal) with the following name cannot be found: "administrators". Check the selected object types for accuracy and ensure you have typed the object name correctly, or remove this object from the selection." In the "Object type" I have "User, group or built-in security principal" selected. In the "from this location" field I have "dom.orgsn.net" selected. If I try to narrow the search down, by selecting "dom.orgsn.net\BuiltIn" as the location, and typing simply "A" as the object name, it returns a list of "Authenticated Users" and "Anonymous logon". No Administrators group. Looking in AD Users and Computers confirms that this group does actually exist. ***?!?! LOL Please help?

10-17-2006, 05:36 AM	#2 (permalink)
crazijoe Registered User Join Date: Oct 2004 Location: Omaha, The Center of the Universe Posts: 7,632 OS: WinXP, Win2K3 My System	Try "Domain Admin". __________________ Microsoft MCSA + Messaging, MVP, A+, Network+ http://i16.photobucket.com/albums/b3...other/Help.jpg Do you want a real Republican? HDD diagnostic tools / HDD data recovery software

10-17-2006, 06:39 AM	#3 (permalink)
stonelaughter Guest Posts: n/a OS:	That wasn't actually my question. I'm not a paper MCSE I'm a real one. I want to know why I can't add BuiltIn\Administrators... in fact it seems to extend to all domain local groups; I can't give Domain Local Groups permissions to files... Last edited by stonelaughter; 10-17-2006 at 06:41 AM.

10-17-2006, 08:38 AM	#6 (permalink)
crazijoe Registered User Join Date: Oct 2004 Location: Omaha, The Center of the Universe Posts: 7,632 OS: WinXP, Win2K3 My System	Builtin groups cannot be used the way you want. They are designed to be used on the domain controllers and the domain controllers only for delegation purposes. You may need to create the DLGs for each of the domains under the users folder in AD. But as far as I know you cannot use BuiltIn groups in that manner. __________________ Microsoft MCSA + Messaging, MVP, A+, Network+ http://i16.photobucket.com/albums/b3...other/Help.jpg Do you want a real Republican? HDD diagnostic tools / HDD data recovery software Last edited by crazijoe; 10-17-2006 at 08:41 AM.

10-19-2006, 09:04 AM	#16 (permalink)
Cellus Moderator Networking Team Join Date: Aug 2006 Location: Canada Posts: 2,664 OS: Windows Vista Business SP1, Windows XP Professional SP3 My System	If the folder you are trying to reference is outside the DC, such as on a separate file server, then referencing the Built-in Domain Locals will not work. Built-in DLs should be considered to be the same thing as Built-in Local groups, except that since DCs share databases, they refer to all the DCs (but only the DCs) in that domain. Built-in Domain Locals and regular Domain Locals are actually two different beasts of the same species. __________________ TSF Networking Team Virus/Trojan/Spyware Removal Help Donate!

10-17-2006, 01:02 PM	#7 (permalink)
whardman Registered User Join Date: Jun 2006 Location: Cincinnati, Ohio Posts: 617 OS: Windows XP My System	If you are looking to add full DOMAIN administrator privileges on a computer/server that is not a domain controller then you must use "Domain Admins". "Administrator" is only available as a local group. If you want to add the local administrator then change the location to the local computer/server.

10-18-2006, 08:04 PM	#13 (permalink)
bilbus TSF Enthusiast Join Date: Aug 2006 Posts: 949 OS: OS2 Warp	sounds like somone needs to reread some of the test materials. builtin local, is not the same as domain local

Thread Tools
Show Printable Version Email this Page Mark Resolved