Announcement

Collapse
No announcement yet.

User removed from group by system

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • User removed from group by system

    We run a Windows Server 2003 environment. I've created a security group into which I added my own user. I subsequently tried adding other users, but they are removed automatically by the NT Authority\System account. The event description is as follows:

    Event Type: Success Audit
    Event Source: Security
    Event Category: Account Management
    Event ID: 633
    Date: 10/08/2005
    Time: 17:24:52
    User: NT AUTHORITY\SYSTEM
    Computer: MANILA
    Description:
    Security Enabled Global Group Member Removed:
    Member Name: CN=Data Admin,OU=Test,OU=Triaster Limited,DC=triaster,DC=co,DC=uk
    Member ID: TRIASTER\Data Admin
    Target Account Name: Triaster Data Admins
    Target Domain: TRIASTER
    Target Account ID: TRIASTER\Triaster Data Admins
    Caller User Name: MANILA$
    Caller Domain: TRIASTER
    Caller Logon ID: (0x0,0xBB20F4)
    Privileges: -


    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Any ideas as to what is causing this would be appreciated.

  • #2
    Re: User removed from group by system

    1. You may use "Restricted Groups"?
    2. The Infra FSMO reside on GC?
    Best Regards,

    Yuval Sinay

    LinkedIn: https://www.linkedin.com/in/yuval14, Blog: http://blogs.microsoft.co.il/blogs/yuval14

    Comment


    • #3
      Re: User removed from group by system

      IM can be on a GC as long as this is single forest domain or all the DCs in the domain are GCs.

      I indeed would be checking if the group in question is configured as Restricted in of of the GPOs.
      Guy Teverovsky
      "Smith & Wesson - the original point and click interface"

      Comment


      • #4
        Re: User removed from group by system

        Thank you both.

        The group was listed as a restricted group in the Default Domain Controller Policy. I don't know why, as I hadn't designated it as such, at least not explicitly. I've removed it from that list, and I'll see what happens.

        Comment


        • #5
          Re: User removed from group by system

          Being listed as a restricted group does indeed seem to have been the problem.

          Thanks again.

          Comment

          Working...
          X