The Gpttmpl.inf file may reference built-in groups by their names instead of by their security identifiers on a Windows XP-based client computer (918451)


The information in this article applies to:

  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition

SYMPTOMS

Consider the following scenario. You update the User Rights Assignment security policy of a domain Group Policy object (GPO) on a Microsoft Windows XP-based client computer. The resulting Gpttmpl.inf file contains the security settings of the GPO. In this scenario, the Gpttmpl.inf file may reference built-in groups by their names instead of by their security identifiers (SIDs) in the Privilege Rights section.

When you install the Multilingual User Interface Pack (MUI) on the client computer, some of the built-in group names are translated to the local language of the client computer.

This behavior occurs even after you install the hotfix that is mentioned in the following Knowledge Base article.

329816 Cannot apply policies that are edited with a computer running Multilingual User Interface Pack

When you apply the domain GPO on some client computers, the following event may be logged in the Application log:Event Type: Warning
Event Source: SceCli
Event Category: None
Event ID: 1202
Date: Date
Time: Time
User: N/A
Computer: Computer name
Description: Security policies are propagated with warning. 0x534 : No mapping between account names and security IDs was done. Please look for more details in TroubleShooting section in Security Help.

CAUSE

This behavior occurs because the built-in groups are not listed in the domain database or in the client computer database. Therefore, the object picker of the client computer does not resolve the built-in groups to SIDs.

STATUS

This behavior is by design.

MORE INFORMATION

To avoid this behavior, we recommend that you change policies only when you work on a domain controller locally or by using Terminal Services.

REFERENCES

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

890737 You receive a "No mapping between account names and security IDs was done" error when you edit and then save a Group Policy object in Windows XP Professional

Modification Type:MajorLast Reviewed:5/26/2006
Keywords:kbtshoot KB918451 kbAudEndUser kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.