Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2005 Forums
 SQL Server Administration (2005)
 SQL Server 2005 Local group access problem.

Author  Topic 

ravilobo
Master Smack Fu Yak Hacker

1184 Posts

Posted - 2009-08-25 : 13:27:47
1. I have a domain group: DM\SQL_R which has many users.
2. And a local group : .\SQL_R (to which the domain group belongs)

When I create a SQL login for the LOCAL GROUP my users are not able to access SQL Server.

However if I create a sql login for the domain group (DM\SQL_R), my users are able to access the DB.

Has anyone faced similar issues?


------------------------
I think, therefore I am - Rene Descartes

YellowBug
Aged Yak Warrior

616 Posts

Posted - 2009-08-26 : 03:32:28
What version of Windows?

When did you modify the local group to include the domain group?
Did the users log off/on after this? Have the users log off/on when assigned to a new group.

Here's a quote from a Windows Server site:
"Your token is only updated at logon....Therefore, if you add a permission for a group to a resource and already have that group membership in your token, the permission will immediately become effective. If you don't have that group in your token, that particular permission won't become effective until your token is refreshed. "

I have this issue when permissioning new groups to shares. Only works after the users have logged off/on - usually the next day.

Does this help in your case?


Go to Top of Page

ravilobo
Master Smack Fu Yak Hacker

1184 Posts

Posted - 2009-08-26 : 10:32:34
Thank you, YellowBug.

Mine is not log on/off problem. I have tried that, its not working. This is something different.

------------------------
I think, therefore I am - Rene Descartes
Go to Top of Page

YellowBug
Aged Yak Warrior

616 Posts

Posted - 2009-08-26 : 11:19:48
Do you have other nested groups like this that work properly? On this server?
Are there any GPOs that maybe preventing this?
Any errors in the event logs?

I'm just guessing... maybe post in a windows forum.
Go to Top of Page
   

- Advertisement -