We use Microsoft Windows 2008 Server as our DCs, and use group policies to distribute access to network shares, software packages etc. Distribution of software packages is done throught LANDesk Desktop Manager.

The challenge is as follows: We have a policy called "Windows 7 free software", to which all users should have access. To achieve this, Domain Users, to which all users (naturally) belong, has been given access to the "Windows 7 free software" policy. This does not work.

I seem to remember that there is a known issue with Microsoft's implementation of LDAP, which causes permissions granted to Domain Users not to propagate properly, and wondered if anyone had any further details on this before I log a change request?


I have not found firm confirmation of this, beyond observing it for myself.

The solution is to avoid using Domain Users to assign permissions, using a different container OU instead.

Update 22/08/17:

I found independent confirmation of the behaviour, stating that:

Most methods do not reveal membership in the "primary" group. For most users, the "primary" group should be "Domain Users". Specifically, the memberOf attribute of user objects, and the member attribute of group objects, never reveals "primary" group membership. In most domains, the member attribute of the "Domain Users" group is empty, and it is safe to assume that all users belong to this group. If you need to query for all users that have "Domain Users" designated as their "primary", search for all users whose primaryGroupID attribute is 513. The primaryGroupToken attribute of the group "Domain Users" is the same integer, 513. The LDAP syntax filter could be: (primaryGroupID=513) Or, to find all direct members of "Domain Users", plus all users that have this group designated as their "primary": (|(memberOf=cn=Domain Users,cn=Users,dc=MyDomain,dc=com)(primaryGroupID=513)) To find all users that have some other group designated as their "primary", the filter could be: (&(objectCategory=person)(objectClass=user)(!primaryGroupID=513))

Source here: https://social.technet.microsoft.com/Forums/windowsserver/en-US/373febac-665c-494d-91f7-834541c74bee/cant-get-all-member-objects-from-domain-users-in-ldap?forum=winserverDS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.