Privileges Are not Assigned if Two Groups or Users Start with the Same Substring

ID: Q232710

The information in this article applies to:

Microsoft Windows NT Server version 4.0 SP4

SYMPTOMS

Microsoft Windows NT 4.0 Service Pack 4 includes the Security Configuration Editor (SCM). A template defines a collection of security settings, including the ability to modify a user's privileges (user rights).

In a template, if two users or groups starting with the same substring are granted the same privilege, only one of two users or groups is effectively granted the privilege when the template is applied to the system.

CAUSE

This problem occurs because the two groups "Users" and "Users2" in the above example both start with the same substring (Users). SECEDIT handles Users2 and then ignores Users because it thinks it has already been handled.

RESOLUTION

A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next Windows NT 4.0 service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:

http://www.microsoft.com/support/supportnet/overview/overview.asp

The English version of this fix should have the following file attributes or later:


   Date      Time      Size      File name      Platform
   -----------------------------------------------------
   05/03/99   09:34p    31,504   Mssce.exe      x86
   05/03/99   09:33p   242,448   Scedll.dll     x86
   05/03/99   09:33p   149,264   Scesmbex.dll   x86
   05/03/99   09:33p    70,416   Secedit.exe    x86
   05/03/99   09:32p    26,384   Sefilshr.dll   x86
   05/03/99   09:33p   384,784   Wsecedit.dll   x86

   05/03/99   09:32p    49,936   Mssce.exe      Alpha
   05/03/99   09:32p   361,232   Scedll.dll     Alpha
   05/03/99   09:32p   230,672   Scesmbex.dll   Alpha
   05/03/99   09:31p   134,416   Secedit.exe    Alpha
   05/03/99   09:31p    40,720   Sefilshr.dll   Alpha
   05/03/99   09:31p   587,024   Wsecedit.dll   Alpha

NOTE: If this product was already installed on your computer when you purchased it from the Original Equipment Manufacturer (OEM) and you need this fix, please call the Pay Per Incident number listed on the above Web site. If you contact Microsoft to obtain this fix, and if it is determined that you only require the fix you requested, no fee will be charged. However, if you request additional technical support, and if your no-charge technical support period has expired, or if you are not eligible for standard no-charge technical support, you may be charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the following article in the Microsoft Knowledge Base:

Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS

Microsoft has confirmed this to be a problem in Windows NT 4.0.

Additional query words: MSSCE


Keywords          : 
Version           : winnt:4.0 SP4
Platform          : winnt 
Issue type        : kbbug

Last Reviewed: July 1, 1999