#46468 - 2003-10-09 12:18 AM
Problem with INGROUP()
|
JohnQ
Starting to like KiXtart
Registered: 2003-03-04
Posts: 171
|
Has anyone encountered a problem with the INGROUP() function? I use it regularly to check for local admin rights.
According to the fine manual:
quote:
When checking for a local group, INGROUP identifies that the user is indirectly a member of the group by virtue of being a member of a global group which, in turn, is a member of the local group.
Most of my users are a member of a global group that is a member of the local admins group. The function works fine most of the time, but every once in a while it will report that a user does not have admin rights when they actually do.
I have tried executing the script with the /f switch to force the cache to clear and that seemed to help but there are still a few users that report no admin rights. The problem users have nothing in common as far as any other group memberships.
Any suggestions?
|
|
Top
|
|
|
|
|
#46469 - 2003-10-09 03:51 AM
Re: Problem with INGROUP()
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
The SIDs for the global groups to which a user is a member are attached to the users security token when the user logs on and is authenticated.
Under some circumstances the user may not have had the global groups properly added to the security token. If this happened then the INGROUP function may not yield the expected result. You can test this possibly by running a test script in a CMD window using the ENNUMGROUP function. This also read the groups from the security token. If no global groups are enumerated then you may have some kind of authentication issue.
In a W2K AD domain this process is done by the GC. If you have not properly setup your GCs or not properly configured your SITEs then this may be a side affect.
|
|
Top
|
|
|
|
|
#46470 - 2003-10-09 03:54 AM
Re: Problem with INGROUP()
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
You say the users with the problemn have nothing in common. Do you mean the problem occurs across all OS's, subnets, and group memberships?
|
|
Top
|
|
|
|
|
#46471 - 2003-10-09 04:19 AM
Re: Problem with INGROUP()
|
JohnQ
Starting to like KiXtart
Registered: 2003-03-04
Posts: 171
|
The users do have one thing in common, that would be the global group that they are all a memeber of that is inside the local admin group. Other than that, it has happened on NT4, 2K and XP - regardless of geography. One user could be in Nebraska and another in California.
It doesn't happen a lot, but enough to be a concern if I need to roll out a patch or something like that. What is strange is that the same users can log on to another PC and the function returns that they have admin rights.
This would make you think the problem is with the other PC. But, I can log on to the other PC with a test account and everything checks out as it should. ![[Confused]](images/icons/confused.gif)
|
|
Top
|
|
|
|
|
#46472 - 2003-10-09 04:32 AM
Re: Problem with INGROUP()
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
As I stated in my original post, you should get a test script together and enumgroup under the user's account when this problem shows it head. If the problem is not repeatable, by user and computer then you may have an underlying network/authentication issue which you will have uncover.
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
1 registered
(Allen)
and 1607 anonymous users online.
|
|
|
