Group Policy Not Applied For Users in Groups with Long Names (307004)
The information in this article applies to:
- Microsoft Windows 98
- Microsoft Windows 98 Second Edition
This article was previously published under Q307004 IMPORTANT: This article contains information about modifying the registry. Before you
modify the registry, make sure to back it up and make sure that you understand how to restore
the registry if a problem occurs. For information about how to back up, restore, and edit the
registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
SYMPTOMS
When you log on to a Microsoft Windows 2000-based domain, and your user account is a member of a group whose name exceeds 20 characters in length, group policies are not applied.
Note that even though the Policy Editor (Poledit.exe) permits you to create a group policy for a group whose name exceeds 20 characters in length, such a policy will never be applied to a client that is running Microsoft Windows 95, Windows 98, or Windows 98 Second Edition.
This restriction does not apply to Microsoft Windows NT clients.
CAUSE
This problem can occur when the client computer does not compare the list of groups that is returned from the server to the list that is contained in the policy file.
The client transacts with the server to obtain a list of groups to which the user belongs. This is effected by using a transaction to access a remote network function that enumerates group membership, by using the Common Internet File System Protocol (CIFS), which is often referred to as Server Message Block (SMB) protocol.
The server returns a list of group names, where the names are less than or equal to 20 characters in length, as well as the total number of group names returned, and the total number of groups to which the user belongs.
If the user belongs to any groups with names longer than 20 characters, the server always returns an error code that indicates there is more data (ERROR_MORE_DATA). The client treats this condition as if there are no group memberships. Because of this, a group policy is not applied. This is a design restriction of the remote function.
Windows NT clients use Remote Procedure Calls (RPCs) to obtain this information, and are not affected by the group name-length restriction.
RESOLUTIONA supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem. To resolve this problem, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site: Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
The English version of this fix should have the following file attributes or later:
Date Time Size File name Operating system
-------------------------------------------------------------------
09-Oct-2001 14:20 11,264 Grouppol.dll Windows 98
09-Oct-2001 13:31 11,264 Grouppol.dll Windows 98 Second Edition
The update described in this article does not fix the problem unless the value shown below is in the registry. See the "More Information" section of this article for instructions about these registry settings.
Value name: UserGroupsIgnoreMoreData
Data type: REG_DWORD
Radix: Decimal
Value data: 1
WORKAROUND
To work around this problem, remove affected users from all groups whose names exceed 20 characters in length.
STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. MORE INFORMATIONWARNING: If you use Registry Editor incorrectly, you may cause serious problems that may
require you to reinstall your operating system. Microsoft cannot guarantee that you can solve
problems that result from using Registry Editor incorrectly. Use Registry Editor at your own
risk. Notes- All versions of the policy editor (Poledit.exe) will allow you to create group policies for groups with names that exceed the 20 character name length limit.
- Windows NT client computers are not affected by this restriction.
- Users that log on to Windows NT client computers can belong to groups with names longer than 20 characters in length. Policies for groups named this way will be applied.
Registry Settings
Set the following value in the registry, and note that to disable the new functionality, change the Value data to "0", or delete the value:
- Start Registry Editor (Regedt32.exe).
- Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies - On the Edit menu, click Add Value, and then add the following registry value:
Value name: UserGroupsIgnoreMoreData
Data type: REG_DWORD
Radix: Decimal
Value data: 1
- Quit Registry Editor.
Alternatively, the following text may be saved to a file with the extension ".reg", and double-clicked, to add the information to the registry:
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies]
"UserGroupsIgnoreMoreData"=dword:00000001
Another option would be to use the following sample .inf files.
To add the registry value, save the following text to a file with the extension ".inf" (for example, Addval.inf), right-click it, and then click Install:
[version]
signature = "$CHICAGO$"
AdvancedINF = 2.5, %AdvPackWarn%
[DefaultInstall]
AddReg = Add.Reg
[Add.Reg]
HKLM,%UpdKey%,%UpdVal%,1,01,00,00,00
[Strings]
UpdKey = "Software\Microsoft\Windows\CurrentVersion\Policies"
UpdVal = "UserGroupsIgnoreMoreData"
AdvPackWarn = "You need a newer version of advpack.dll."
To set the value to "0" with a similar file, the [Add.Reg] section should be:
[Add.Reg]
HKLM,%UpdKey%,%UpdVal%,1,00,00,00,00
To remove the registry value, save the following text to a file with the extension ".inf" (for example, Delval.inf), right-click it, and then click Install:
[version]
signature = "$CHICAGO$"
AdvancedINF = 2.5, %AdvPackWarn%
[DefaultInstall]
DelReg = Del.Reg
[Del.Reg]
HKLM,%UpdKey%,%UpdVal%
[Strings]
UpdKey = "Software\Microsoft\Windows\CurrentVersion\Policies"
UpdVal = "UserGroupsIgnoreMoreData"
AdvPackWarn = "You need a newer version of advpack.dll."
The following command can be run from a command line, or in a batch process, to automate an installation of any of the preceding sample INF files although you will need to replace FILENAME.INF with the actual name of the file:
rundll32 advpack.dll,LaunchINFSection FILENAME.INF,DefaultInstall,3,NFor additional information about rundll, click the article number below
to view the article in the Microsoft Knowledge Base:
164787 INFO: The Windows 95 Rundll and Rundll32 Interface
For additional information about advpack, see the Internet Explorer Administration Kit (IEAK). To locate information about this product, search for "IEAK" (without the quotation marks) on the following Microsoft Web site:
For additional information about Windows 98 and Windows 98 Second Edition hotfixes, click the article number below
to view the article in the Microsoft Knowledge Base:
206071 General Information About Windows 98 and Windows 98 Second Edition Hotfixes
| Modification Type: | Minor | Last Reviewed: | 10/18/2005 |
|---|
| Keywords: | kbHotfixServer kbQFE kbbug kbenv kbfix kbnetwork kbQFE KB307004 |
|---|
|