2

I have a single domain forest at Windows Server 2003 functional level (Domain and Forest are both at 2003). We have 3 Domain Controllers running Windows Server 2003, all of which are Global Catalogs.

We have several Global Security Groups each with several members. However when using Active Directory users and Computers to view Members of these groups, the list is empty. If I go to individual users and check the list for Member Of, I do see the associated groups.

I've also tried to user the PowerShell Get-AdGroupMember cmdlet, but it also returns an empty list.

The rights associated with these groups work for the associated users.

On the left is the Member Of list for my account. On the right is the group that I am a member of, but it shows no members on the Members tab.

enter image description here

If I add someone who is not a member already, they will be added and listed. The next time I load the properties page, it will show empty again. If I add someone who is already a member, when I try to save the Group it will tell me they are already a member.

So functionally it works. I just need to be able to enumerate the members.

Anyone see this before or have ideas on how to correct the issue?

2
  • 1
    Both the Domain functional level and Forest functional level needs to be at least 2003 for link-value replication (LVR, member-memberOf consistency) to function Feb 5, 2015 at 18:20
  • Forest functional level is 2003. Feb 9, 2015 at 19:54

2 Answers 2

0

From a login for one of these users, invoke:

gpresult /v /scope user

Look for the heading:

The user is a part of the following security groups

Are there any groups listed?
Is it possible a different group, or a non-group method is granting the users these privileges?

***Followup:

Thanks for the pics. Trying imagine what may lead to this. Possibly a limit on enumerating the group properties. Perhaps someone in your org modified perms for these groups? Does the problem exist on all groups, or only a small subset? If the later, do they reside in a common OU, perhaps with more restrictive permissions?
Run DSACLS passing it the DN of the group name.

DSACLS "CN=groupname,DC=mydomain,DC=com"

It will be long, you may want to redirect to a text file. Are there any DENY ACLs?

What is the ACL for "Authenticated Users"? It should resemble like this

Allow NT AUTHORITY\Authenticated Users
                                  SPECIAL ACCESS
                                  READ PERMISSONS
                                  LIST CONTENTS
                                  READ PROPERTY
                                  LIST OBJECT
7
  • Yes, there are several groups listed including the groups that show 0 members. No, all privileges are granted via these groups. I've added a little more info to the question. Hopefully that clarifies the issue. Feb 5, 2015 at 16:59
  • I think Mathias' explanation above is probably the more likely cause here.
    – Clayton
    Feb 5, 2015 at 22:04
  • I don't think anyone would have modified perms. Problem only exists on a subset of groups. Affected groups are in the same OU, however this OU has several groups; the majority of which behave normally. Feb 9, 2015 at 20:16
  • DSACLS shows two permissions with DENY. Feb 9, 2015 at 20:16
  • Went over the 5 min edit limit. Here's what the above comment should have read: DSACLS shows Deny Everyone - SPECIAL ACCESS for Add/Remove self as member - READ PROPERTY. I used DSACLS /S to reset permissions and the Deny ACL was removed. The members tab still showed empty so I logged off the DC and back on. Members tab still showed empty and after re-running DACLS the Deny ACLs were back. I'm not convinced this is the issue as it appears to affect the read property of the self add /remove and not the write. It doesn't seem to be related to the listing of members. It is interesting though. Feb 9, 2015 at 20:24
0

The group's membership was hidden due to a configuration of the Exchange properties of the Security Group. Right clicking the group allows access to Exchange Tasks. From there I was able to Unhide Membership. The end result changed the security properties to allow viewing the group's membership.

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .