1

We have an AD forest. Root domain plus 3 child domains. We delegate permissions to the help desk so that they can create accounts and manage them in all domains. They are also given relevant manage user group permissions as well. This all works fine. One thing we have noticed is that for child domain users the Help desk people cannot see Universal groups that have been added under member of tab of the User account. They can add the group fine and can change locations to the root domain when adding the group to the user account. If they try to add the group again because they can’t see it they get an error that the user is already a member of the group. As overall administrator I can see the groups fine under child domain users. I am thinking that I am missing a delegation from somewhere?

Anyone have an idea on this?

2 Spice ups
2

Are you still running Server 2003? If so, this article should apply:

2 Spice ups
3

No we are at 2008 domain level now, but we did come from a 2003 domain recently. The problem in the linked article is exactly the same issue we are experiencing.

4

eesh Microsoft.

The problem we are experiencing is the same. All of our DC’s are global catalog servers so ADUC should be showing universal groups even if they do not reside on the local domain. Yet ADUC is not showing but the stated hotfix seems to be for workstations and not your domain controllers. I am researching to see if this applies at the DC or local workstation level.

5

What domain/forest functioning level are you running?

6

We are at the 2008 Forest level, the root domain is at 2008 level and our child domains are at 2008 R2 level. As recently as 6 months ago we use to be at the 2003 domain and forest level. Originally this domain started out as 2000 level and has been upgraded over the years.

7

So I used Active directory administrator center and it shows the universal groups. Its just ADUC that is the problem. I am going to try the registry fix in that article you linked on a workstation and see if that works.

8

I can’t believe it… just implementing the registry change on a workstation running ADUC fixed the issue.

Good link and information!!!

2 Spice ups
9

Cool, glad it worked out… Were the DC’s fresh installs of 2008 or upgrades?

10

We no longer have the original DC’s that started out with this domain. They have been phased out and replaced over the years. They were always replaced with freshly installed and promoted DC’s.