westleya Posted March 31, 2009 Posted March 31, 2009 I have a bit of an odd problem. I'm currently setting up a brand new server/domain, etc for one of our local feeder primarys. We're using Server 2003 (Standard ed, SP2), just a single domain controller. The new server is sitting on the same physical network as the old one. I have set up a 'Staff' security group in AD. I then add the staff members to this group - all fine and good. I then come in the next morning, log on to the server and discover that the Staff group has no members. This happens every day and I can't find anything in the event logs as to why this is happening. I have another security group with just a couple of staff members in it and these staff members STAY in the group. Totally baffled. HELP ! Regards all Adrian
contink Posted March 31, 2009 Posted March 31, 2009 My guess would be that you have a script running somewhere that recreates the security group. 1
SYNACK Posted March 31, 2009 Posted March 31, 2009 The idea would be so set up auditing on user events then check the log in the morning to see what credentials are being used to remove them and when the removal is occouring. 1
westleya Posted March 31, 2009 Author Posted March 31, 2009 The idea would be so set up auditing on user events then check the log in the morning to see what credentials are being used to remove them and when the removal is occouring. It's just done it again, almost right in fron t of my eyes... However, looking in the Security event logs, I have a whole load of entries with Event ID 633 and 641 where it shows the following (example): Source: Security Category: Account Management Type: Success A Event ID: 633 User: NT Authority\system Computer: Server01 Security Enabled Global Group Member Removed Member Name: DN=Julie Sutton,OU=Staff,OU=school,DC=fairfieldjnr,DC=internal Member ID: FAIRFIELDJNR\juliesutton Target Account Name: staff Target Domain: FAIRFIELDJNR Target Account ID: FAIRFIELDJNR\Staff Caller User Name: SERVER01$ Caller Domain: FAIRFIELDJNR Caller Logon ID: (0x0,0x1D76005) Privileges: _ I get one for every staff member... Seems this thing's got a mind of it's own. I don't have any clever scripts, or indeed anything weird set up at all on this server... Odd, odd, odd.
mossj Posted March 31, 2009 Posted March 31, 2009 (edited) I had a simular problem, which happened because they where part of the 'Print Operator' group but it was only turning inheritance off, on every user every 15 - 25 mins , not removing groups (although I didn't check for that...). Could be worth a look? depending on how your applying them to the group. P.S I sorted it by changing the replication container (turned inheritance on) that AD stamps on them, then wait 15 - 20 mins and it will stamp the new container everywhere. P.S.S I think it happens to all 'builtin' groups hence why your not supposed to use them. Edited March 31, 2009 by mossj 1
westleya Posted March 31, 2009 Author Posted March 31, 2009 OK, I don't THINK it's any of the above. Have simply deleted the security group and re-added it (and re-done the security on all the relevane folders). Will keep an eye on it this afternoon
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now