Users are disappeared from security groups
Windows Server Forum Index Windows Server
Server discussion on Windows platform.
 
 FAQFAQ   MemberlistMemberlist     RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 
 
Google
 
Web winserverhelp.com
Users are disappeared from security groups

 
Post new topic   Reply to topic    Windows Server Forum Index -> Security
Author Message
Marc
Guest





Posted: Wed Oct 19, 2005 4:51 pm    Post subject: Users are disappeared from security groups Reply with quote

I have a problem with some user accounts, the accounts are disappearing
out of some security groups.
We have 4 domain controllers in our Windows 2000 domain.
Since a couple of weeks some new users are disappearing from some
security groups.
I can not find the solutions for this problem, maybe someone can help
me out.

Regards, Marc
Back to top
Roger Abell [MVP]
Guest





Posted: Wed Oct 19, 2005 4:51 pm    Post subject: Re: Users are disappeared from security groups Reply with quote

Are the users disappearing only from specific groups?
If so, are these predefined groups?
Have these accounts that disappear random? or, do they
have things in common, specifically have they been
delegated priveleges/rights in AD ?

--
Roger Abell
Microsoft MVP (Windows Server : Security)
MCDBA, MCSE W2k3+W2k+Nt4
"Marc" <info@consulit.nl> wrote in message
news:1129729455.888210.106380@o13g2000cwo.googlegroups.com...
Quote:
I have a problem with some user accounts, the accounts are disappearing
out of some security groups.
We have 4 domain controllers in our Windows 2000 domain.
Since a couple of weeks some new users are disappearing from some
security groups.
I can not find the solutions for this problem, maybe someone can help
me out.

Regards, Marc
Back to top
Marc
Guest





Posted: Thu Oct 20, 2005 8:51 am    Post subject: Re: Users are disappeared from security groups Reply with quote

The users are disappearing random, from two specific groups.
This are groups witch I have made a couple of years ago.
Only users that are made since a couple of weeks ago are disappearing
from the groups, even when I add them again to the specific group.
The only thing they have common is that they are made since a couple of
weeks ago, I can not find some specific error messages.
Back to top
Steven L Umbach
Guest





Posted: Fri Oct 21, 2005 4:51 pm    Post subject: Re: Users are disappeared from security groups Reply with quote

Try enabling auditing of account management for the domain controllers
and/or for the computers where this is happening if they are local groups.
Then look in the security logs for account management events that would show
who removed the users and when. If the user is system then most likely Group
Policy Restricted Groups or a startup script is being used. -- Steve


"Marc" <m.kwaad@quicknet.nl> wrote in message
news:1129798190.242956.40680@g47g2000cwa.googlegroups.com...
Quote:
The users are disappearing random, from two specific groups.
This are groups witch I have made a couple of years ago.
Only users that are made since a couple of weeks ago are disappearing
from the groups, even when I add them again to the specific group.
The only thing they have common is that they are made since a couple of
weeks ago, I can not find some specific error messages.
Back to top
Marc
Guest





Posted: Sun Oct 23, 2005 8:50 am    Post subject: Re: Users are disappeared from security groups Reply with quote

I am going to enable auditing of account management.
This are no local group, are domain groups.
It happens at users which are added to the ad since a couple of weeks.

There are no restricted group policys defined.

Thanks for your information.
Back to top
Marc
Guest





Posted: Mon Oct 24, 2005 12:50 pm    Post subject: Re: Users are disappeared from security groups Reply with quote

Hi Steven,

Thanks for your suggestion
Auditing is running and eventcombmt is running, some users lost again
there membership but there is nothing logged.
When I do this manually I see event 633 member removed from global
group.

Any idea?

Thanks! With regards Marc
Back to top
 
Post new topic   Reply to topic    Windows Server Forum Index -> Security All times are GMT
Page 1 of 1

 
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum




New Topics Powered by phpBB