Admit
it... You are confused. :o)
How
much you guys paying chimps now a days?
joe
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Kingslan
Sent: Wednesday, November 19, 2003 1:06 AM
To: [EMAIL PROTECTED]
Oh - I'm *NOT* the one confused..... I *DO* use the cli
tools.
However, the paid chimps - now THAT'S another
story!
;o>
Rick Kingslan MCSE, MCSA, MCT
Microsoft MVP - Active
Directory
Associate Expert
Expert Zone -
www.microsoft.com/windowsxp/expertzone
WebLog -
www.msmvps.com/willhack4food
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe
Sent: Tuesday, November 18, 2003 8:49 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] MMC ADUC doesn't view groups I am a member of in my non local domain
Yeah,
One thing I love about MS is the concept of having multiple groups for your
membership. One thing I hate about MS is how they handle the bloody things...
:o)
You
shouldn't be confused jumping between 2K and 5.2... Use the command line
man!
joe
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Kingslan
Sent: Monday, November 17, 2003 11:31 PM
To: [EMAIL PROTECTED]
Joe,
Make no mistake - I think the change *IS* for the better -
consistency is better than inconsistency. But, it really shouldn't be this
way in the first place. There should be no reason for me to have to weigh
the averages or go from domain to domain to determine what the REAL
membership is.
Granted, I now am quite conformable with looking in more
'specific', non-traditional (read:invisible to the naked eye) and using new
tools to determine what the real membership of a given SP
is.
I just don't agree that it's a good move. If it's
confusing to me going from Windows 2000 forests to Win2k3 forests (on the same
day), imagine what it's like for REAL neophytes.
It does give me a reason to think again - that's a nice
change!
Rick Kingslan MCSE, MCSA, MCT
Microsoft MVP - Active
Directory
Associate Expert
Expert Zone -
www.microsoft.com/windowsxp/expertzone
WebLog -
www.msmvps.com/willhack4food
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe
Sent: Monday, November 17, 2003 7:36 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] MMC ADUC doesn't view groups I am a member of in my non local domain
I'm
sending one too, but it is going to say great job! Thanks for working towards
consistency. :o)
It
should be good weight as well because I usually am complaining about something.
Last time I talked to him I was trying to talk him into giving me AutoGroup - No
I don't mean AutoDL.
joe
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kingslan, Rick T.
Sent: Monday, November 17, 2003 2:12 PM
To: [EMAIL PROTECTED]
Guido,
So, you're saying that Andreas is the one that we need to
'convince' that this isn't such a great change? I've noted this in my
testing, and know that I've got a huge learning curve with some of my admins,
who don't yet grasp the way that Windows 2000 manages viewing group
memberships.
Yep - I can drop him a note as well.
;o)
Rick
Kingslan MCSE, MCSA, MCT
Microsoft MVP - Active Directory
LAN Administration - Windows 2000
West Corporation
[EMAIL PROTECTED]
Microsoft MVP - Active Directory
LAN Administration - Windows 2000
West Corporation
[EMAIL PROTECTED]
From: GRILLENMEIER,GUIDO (HP-Germany,ex1) [mailto:[EMAIL PROTECTED]
Sent: Friday, November 14, 2003 3:59 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] MMC ADUC doesn't view groups I am a member of in my non local domain
Hello Alan, I can see that you won't like this -
it goes without saying, that you're talking about Universal Groups
from other domains in your forest - correct?
In 2000, when connected to a GC, ADMU would display your UG
memberships even when they're from a different domain (as a GC would create the
appropriate BackLinks to your AD account). However, when you connect to
"just" a DC, you would not see these memberships either (as the DC has no clue
of the UGs of another Domain). Ofcourse, even a GC has no idea, which
Domain Local Groups in other domains you are a member of, as
the members of DLGs are not replicated to GCs....
The 2k3 version of ADMU is somewhat more consistent, in
that it ONLY displays your memberships of groups in the SAME domain that you're
connected to. Not so nice, if you've got used to seeing the other UGs on
your GCs, but maybe more consistend overall.
However, don't forget, that the BackLinks to your AD
accounts still exist on a GC - you can see them by checking the memberOf
attribute of the account using other LDAP tools, such as ADSIedit. Here
you will also see the UGs of the "foreign" domains in your
forest.
This bug is a feature - if you don't like it, let me know -
as I also don't like it... and I'm talking to the MS PM about this for sometime
already - but I'm sure you can add some weight to it with a mail to A.L.
yourself as well ;-). Anyone else don't like this "update" ?
;-))
Cheers,
Guido
From: Isham, Alan A [mailto:[EMAIL PROTECTED]
Sent: Freitag, 14. November 2003 17:46
To: [EMAIL PROTECTED]
Subject: [ActiveDir] MMC ADUC doesn't view groups I am a member of in my non local domain
Anyone have a known
workaround for the issue below?
I installed MMC Active Directory Users and Computers from
Windows Server 2003 (version 5.2.3790.0) on a new desktop. I can no longer
view groups I am a member of in groups that reside outside of my local domain
like I could with Windows 2000 (version 5.1.3590.0). I've searched MSDN
and Microsoft Support, but don't find any hacks to
resolve.
For example,
User account is amr\jdoe
amr\jdoe is a member of amr\group1, gar\group2,
ger\group3
In MMC AD UC Windows 2000 version 5.1.3590.0, I see the
following:
Doe, John Properties
Member of:
Name Active Directory
Folder
Group1 amr.corp.company.com/blah, blah,
blah
Group2 gar.corp.company.com/blah, blah,
blah
Group3 ger.corp.company.com/blah, blah,
blah
In MMC AD UC Windows Server 2003 version 5.2.3790.0, I see the
following:
Doe, John Properties
Member of:
Name Active Directory
Folder
Group1 amr.corp.company.com/blah, blah,
blah
Where is
Group2 and
Group3???
Thanks for your
help!
Alan A Isham
Active Directory
Engineering
Intel Corporation in Folsom,
California
