Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have deployed a .NET application to a machine running Windows Server 2008 R2. The application uses Windows Authentication, and will only allow access to members of any of 3 particular roles.

The application is currently not letting anyone in, even users who are members of these roles. I logged into the machine myself and, using PowerShell, typed in the command

whoami /Groups

This lists my role membership, and interestingly, doesn't include any of the roles that my application requires. Presumably this is why noone is able to use the application: the computer itself cannot detect that users are members of the required roles.

I don't have control over the network but the admins assure me that the relevant users are assigned to the correct roles in Active Directory. All users and roles mentioned are domain users and roles.

Is there some fine-grained subtlety of domains in AD I'm unaware of? For example, are there subdivisions of a domain for which some roles are not visible? I'm pretty stuck here.

share|improve this question
What types of groups? Universal/Global/Security/Distribution? – Greg Askew Jan 31 '13 at 15:22
1. They're called groups, not roles. 2. Are these domain or local groups? 3. Are these domain or local users? – joeqwerty Jan 31 '13 at 22:35

Administrative and privileged group membership (Account Operators, etc) is stripped out of the user's token by UAC. If you rely on those, they won't be there without elevation.

If it's just normal security group membership, then I think your "AD Guys" might need to double check their work.

share|improve this answer
Does 'Administrative and privileged group membership' only include built-in groups? The groups I need are ones created specifically for the use of this application. I've actually seen a screenshot of the AD user screen showing I'm in the relevant groups... – David Jan 31 '13 at 15:07
@David then UAC shouldn't be stripping that membership. – MDMarra Jan 31 '13 at 15:07
Okay, thanks for clarifying. – David Jan 31 '13 at 15:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.