Re: foreign language gpo

Hi,

Andrew Story schrieb:
Part of my issue was that I added a policy to allow power users the rights
to add/remove device drivers. It works fine on all machines apart from some
that have a French OS. These particular clients have lots of SCEcli event
id:1202 errors, this seems to be caused by the fact that the name of the
power users group on a french OS is spelt different than from an English OS
(most machines are win2k, Policy editing machine is Win XP with GPMC).

Alright, then you don´t have only the problem of ADMs, which is easy
to handle, because ADMs are only in the wrong language, but still work,
because it´s only registry editing.

Your problem with the Power Users Group is a little bit more difficult.

The problem is, that your edit the GPO from a system, that did not write
the SID of the group into the GPO, it wrotes the STRING (Name) of the
group and the name is always different in the different languages.
You need the SID (Wellknown ID) of the group inside your GPO, to get it
work.
Usually, if you use the GPMC on a DC (not a 2003 member srv, or XP
Workstation) the DC will always use the SID, not the Name.
There is a known "bug" if you are editing from a member and enter the
name of the group without browsing the AD.
There is a special issue with the "Power Users", because they are not
existent in a AD, only locally on a client and so, the group can´t be
found by browsing.

Best way to handle it:
Take a client and open MMC -> Snapin "Security Templates" -> create a new
Edit the template to fit your need and save the "mysettings.inf".
Open the file:

It should look like this:
[Unicode]
Unicode=yes
[Version]
signature="$CHICAGO$"
Revision=1
[Privilege Rights]
SeLoadDriverPrivilege = Power Users
^^^^^^^^^^^
thats the NAME/STRING we don´t want this!

Change it to:
SeLoadDriverPrivilege = *S-1-5-32-547

"Well-known security identifiers in Windows operating systems"
http://support.microsoft.com/kb/243330/en-us

Be sure to add the "*", otherwise, the "number" will be taken as
a STRING and not as a SID.

Save this file and open the GPO, move to "Security Settings" in
your computer config and right click on it. Import your INF file.

Now, the "SeLoadDriverPrivilege" is defined to use the Wellknown SID
and it will work in every language.

Mark
--
Mark Heitbrink - MVP Windows Server - Group Policy

Homepage: www.gruppenrichtlinien.de - deutsch
Blog: gpupdate.spaces.live.com - english
.

Relevant Pages

  • Re: foreign language gpo
    ... (most machines are win2k, Policy editing machine is Win XP with GPMC). ... Your problem with the Power Users Group is a little bit more difficult. ... The problem is, that your edit the GPO from a system, that did not write ... You need the SID of the group inside your GPO, ...
    (microsoft.public.windows.group_policy)
  • Re: Making users "Power Users"
    ... It's a viable method -- but not nearly as clean as the GPO. ... Is there a way to make a user a power user on all machines using Active ... Windows 2000 servers and say to use Restricted Groups in Group Policy. ... when I go there the Power Users group doesn't appear because (I ...
    (microsoft.public.windows.server.active_directory)
  • Re: MultiLanguage Power User group membership with GPO
    ... I don't think you can use this in the GPO though... ... SID: S-1-5-32-547 ... Name: Power Users ... If I create a GPO that force membership for both group, ...
    (microsoft.public.windows.server.active_directory)
  • Re: DST Updates Deployed via Group Policy
    ... if they are just reg settings and nothing more then ... WAS able to select the group in the GPO editor so I assumed that it ... things are working, that is, the machines are being healthy little ... however I have not tested the script locally on ...
    (microsoft.public.windows.group_policy)
  • Re: DST Updates Deployed via Group Policy
    ... In KB914387 Microsoft gives you the registry keys that need to be changed ... saw that my EST reg entries were the same as my 2003 server and 2000 ... WAS able to select the group in the GPO editor so I assumed that it could ... things are working, that is, the machines are being healthy little ...
    (microsoft.public.windows.group_policy)