Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a developer who is setting up a virtual domain environment of testing purposes and am having trouble with the setup.

I have created a new DC on a new Forest... call it I have setup a virtual internal network for all machines that are going to be apart of this virtual test environment and have given each machine a static IP address in the subnet. I have added to the domain I have also provisioned a user account (adminuser) in the domain and made that user a member of Domain Admins group.

Upon logging into machine1 using my newly created Domain Admin account, I cannot access/run any files on machine1. When I go into the advanced permissions for the c:\ folder and goto properties -> Security Tab -> Advanced -> Effective Permissions and search for the dev\adminuser (mentioned above), I get an error saying:

Windows can't calculate the effective permissions for admin user

What do I need to do to get Administrative rights on Machine1? I am using Server 2008 R2 for both the AD controller and machine1.

share|improve this question
Did you login to the domain or the local computer? On WinXP there is usually a drop down menu on the login screen, make sure the domain is selected. For Vista and Win7 you can type as the username to log on to the domain – smoak May 19 '10 at 19:12
I logged onto both and got the same results both locally and when logged into the domain account. As mentioned above, I am using Server 2008 so I used dev\adminuser as well as machine1\administator – Rob May 19 '10 at 19:24

Ok, after replaying all of this more than once, I looked at the logs closer after each step. This revealed and issue with the SID, and then it hit me! I need to have a different SID when you have cloned the domain controller. This article The Machine SID Duplication Myth by Mark Russinovich states you don't need to NewSid anymore. This is true based on the article which I read quite some time ago. However, this doesn't apply if you are working with an AD DC which some of the comments on that article suggest.

So, after rebuilding a new VM fresh with Server 2008 (instead of cloning from an original base VHD with Server 2008). Everything works as expected.

share|improve this answer
The SID Myth applies to workstations, not servers. There are many things related to servers where they need a unique SID. Always use sysprep on cloned servers. – Chris S Dec 8 '10 at 15:55

Seems like the users group policy is not being applied. Is there an event log on the error? Are you sure you have your group policy setup on the OU that this computer is part of?

@ SMOAK Seems like he is logging into the domain as his user account would not work on the local machine. Unless he has a local and domain user with the same user name and password.


Seems like they are pulling the Group Policy from the domain not the virtual domain.

Go to AD in the OU that contains the computers right click the OU then go to properties then select the "Group Policy" tab. Add your group policy there. Group policies are applied from bottom to top and override each other.

share|improve this answer
I do not have a local user with the same username – Rob May 19 '10 at 19:33
I know you don't... @smoak was thinking you were logging in to the local machine. I pointed out that you could not do this unless they were the same. – Campo May 19 '10 at 19:37
Edited in my answer – Campo May 19 '10 at 20:21
I'm not quite following. When I go into the group policy editor, I see the default policies. I did not make my own. I also double checked to make sure that the default GPO is being enforced. I'm not sure why its trying to use the path \\ instead of \\ – Rob May 19 '10 at 20:46
did you apply the group policy for the virtual domain not your physical domain GP? – Campo May 19 '10 at 20:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.