Re: foreign language gpo

Mark - thankyou.

Your help is very much appreciated.




"Mark Heitbrink [MVP]" <spam-only@xxxxxxxxxxxxxxxxxxxxx> wrote in message
news:OhPVv$N1HHA.1184@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

Andrew Story schrieb:
Part of my issue was that I added a policy to allow power users the
rights
to add/remove device drivers. It works fine on all machines apart from
some
that have a French OS. These particular clients have lots of SCEcli
event
id:1202 errors, this seems to be caused by the fact that the name of the
power users group on a french OS is spelt different than from an English
OS
(most machines are win2k, Policy editing machine is Win XP with GPMC).

Alright, then you don´t have only the problem of ADMs, which is easy
to handle, because ADMs are only in the wrong language, but still work,
because it´s only registry editing.

Your problem with the Power Users Group is a little bit more difficult.

The problem is, that your edit the GPO from a system, that did not write
the SID of the group into the GPO, it wrotes the STRING (Name) of the
group and the name is always different in the different languages.
You need the SID (Wellknown ID) of the group inside your GPO, to get it
work.
Usually, if you use the GPMC on a DC (not a 2003 member srv, or XP
Workstation) the DC will always use the SID, not the Name.
There is a known "bug" if you are editing from a member and enter the
name of the group without browsing the AD.
There is a special issue with the "Power Users", because they are not
existent in a AD, only locally on a client and so, the group can´t be
found by browsing.

Best way to handle it:
Take a client and open MMC -> Snapin "Security Templates" -> create a new
Edit the template to fit your need and save the "mysettings.inf".
Open the file:

It should look like this:
[Unicode]
Unicode=yes
[Version]
signature="$CHICAGO$"
Revision=1
[Privilege Rights]
SeLoadDriverPrivilege = Power Users
^^^^^^^^^^^
thats the NAME/STRING we don´t want this!

Change it to:
SeLoadDriverPrivilege = *S-1-5-32-547

"Well-known security identifiers in Windows operating systems"
http://support.microsoft.com/kb/243330/en-us

Be sure to add the "*", otherwise, the "number" will be taken as
a STRING and not as a SID.

Save this file and open the GPO, move to "Security Settings" in
your computer config and right click on it. Import your INF file.

Now, the "SeLoadDriverPrivilege" is defined to use the Wellknown SID
and it will work in every language.

Mark
--
Mark Heitbrink - MVP Windows Server - Group Policy

Homepage: www.gruppenrichtlinien.de - deutsch
Blog: gpupdate.spaces.live.com - english


.

Relevant Pages

  • Re: foreign language gpo
    ... (most machines are win2k, Policy editing machine is Win XP with GPMC). ... Your problem with the Power Users Group is a little bit more difficult. ... The problem is, that your edit the GPO from a system, that did not write ... You need the SID of the group inside your GPO, ...
    (microsoft.public.windows.group_policy)
  • Re: Making users "Power Users"
    ... It's a viable method -- but not nearly as clean as the GPO. ... Is there a way to make a user a power user on all machines using Active ... Windows 2000 servers and say to use Restricted Groups in Group Policy. ... when I go there the Power Users group doesn't appear because (I ...
    (microsoft.public.windows.server.active_directory)
  • Re: MultiLanguage Power User group membership with GPO
    ... I don't think you can use this in the GPO though... ... SID: S-1-5-32-547 ... Name: Power Users ... If I create a GPO that force membership for both group, ...
    (microsoft.public.windows.server.active_directory)
  • Re: MultiLanguage Power User group membership with GPO
    ... I've try to use the SID and it's not doing reverse SID, ... How is call the power users group on the Russian Version? ... you are using the SID in the restricted group entry? ... If I create a GPO that force membership for both group, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Add custom local user to NTFS rights from GPO
    ... Why this feature of manually being able to add users in User Rights Assignment is available and NOT in NTFS Perms GPO Settings: ... But when I type in the object it always resolves to the SID, i.e. it first checks to see that the object exists on a domain or target machine. ... We need to do this because we would like to put all of the special NTFS permissions in the GPO, but the problem is that we are adding custom local group. ...
    (microsoft.public.windows.group_policy)