Computer Does Not Allow ANY Use To Search Using AD Group Alias Nam

Would anyone happen to know why a computer would not allow ANY user (even
Domain Admins) to search for an AD Universal Security group by its Alias name
when this works fine on other computers? For example, if you want to add an
AD Universal Security group to the local Administrators group, you would
bring up a search box and type in part of the name and it should find it
either by display name or alias, but it is not doing it on this one computer.

v-dashen
Fri Mar 28 01:56:28 PDT 2008

Dear Customer,

Thank you for posting in newsgroup.

According to the description, I am a little confused with display name and
Alias name of Universal Security Group in Active Directory.

Before we move on, I have some information to confirm with you first.

Information Needed:
======================

1. What is the version of the operation system that you encounter this
issue, Windows Server 2003 or Windows 2000 Server?

2. You just mention that the computer would not allow any user to search
for an AD universal security group by it Alias name while this works fine
on other computers. Is the problematic computer a domain controller or a
member server?

3. What is the form of the display name and Alias of the Universal Security
Group? Could you please describe it clearly?

Analysis and Suggestion:
========================

Based on my research, when we add an Universal Security Group to the local
Administrators group, it brings up a dialog box with "Select Users,
Contacts, Computers or Group" and we may search the name of the Universal
Security group. When we find it, the group name is shown only in the form
of "universal group" (not appended with "@domainname.com"). If we add a
user to the group, it can show both in the form of "test" and "test
(test@contoso.com)"

To narrow down the issue, would you please send the screenshot of the
display name and Alias name of the universal security group that you
mentioned to my e-mail?

Please send to E-mail: v-dashen@microsoft.com

I look forward to your reply.

Thanks for your time.

David Shen
Microsoft Online Partner Support

BrianG
Fri Mar 28 14:56:00 PDT 2008

1 & 2. This error is occuring on a WinXP Pro SP2 computer. From that
computer the same user can terminal into any server and does not have a
problem. When I use my WinXP Pro SP2 computer, I can lookup the group by
alias name, but not when I log onto the first WinXP Pro SP2 computer.

3. The AD Display Name is "~ Accounting Group", the Exchange Display Name is
"Accounting", and the Exchange Alias Name is "Accounting". There is no
Exchange Simple Display Name. On every other computer I can type in
"Accounting" or "acc" and the "~ Accounting Group" will display.

I've never seen this problem before and we've had the names like this for a
few years now. This WinXP computer also happens to be ~1yr old and is used
by a developer that has Admin Rights to his computer.

I have sent a screen capture to your e-mail address.

Brian

"David Shen [MSFT]" wrote:

> Dear Customer,
>
> Thank you for posting in newsgroup.
>
> According to the description, I am a little confused with display name and
> Alias name of Universal Security Group in Active Directory.
>
> Before we move on, I have some information to confirm with you first.
>
> Information Needed:
> ======================
>
> 1. What is the version of the operation system that you encounter this
> issue, Windows Server 2003 or Windows 2000 Server?
>
> 2. You just mention that the computer would not allow any user to search
> for an AD universal security group by it Alias name while this works fine
> on other computers. Is the problematic computer a domain controller or a
> member server?
>
> 3. What is the form of the display name and Alias of the Universal Security
> Group? Could you please describe it clearly?
>
> Analysis and Suggestion:
> ========================
>
> Based on my research, when we add an Universal Security Group to the local
> Administrators group, it brings up a dialog box with "Select Users,
> Contacts, Computers or Group" and we may search the name of the Universal
> Security group. When we find it, the group name is shown only in the form
> of "universal group" (not appended with "@domainname.com"). If we add a
> user to the group, it can show both in the form of "test" and "test
> (test@contoso.com)"
>
> To narrow down the issue, would you please send the screenshot of the
> display name and Alias name of the universal security group that you
> mentioned to my e-mail?
>
> Please send to E-mail: v-dashen@microsoft.com
>
> I look forward to your reply.
>
> Thanks for your time.
>
> David Shen
> Microsoft Online Partner Support
>
>

v-dashen
Mon Mar 31 04:28:06 PDT 2008

Hello Brain,

Thanks for your reply.

According to the description, the issue seems to be related to the Windows
XP problematic client.

Based on my test, this seems to be unexpected behavior.

Information needed:
=================

To isolate the exact issue, please collect the following information and
perform some tests:

1. Is the problematic computer a member of the domain?

2. You mentioned that you can look up the group by its alias name when you
use your Windows XP Pro SP2, I wonder did you logon your computer with the
domain users' credential or just local admins' credential?

3. The problematic client is used by a developer that has admin rights, did
you mean that the developer logon the domain with domain admins' credential
or just logon to the local computer with the local admins' credential?

4. Can you search another universal Security group by part of the group
name besides the "~ Accounting Group" on the problematic client with domain
users' credential? Please also try with the local administrator credential.

5. Can you search another universal Security group by its alias name
besides the "~Accounting Group" on the problematic client with domain user'
credential? Please also try with the local administrator credential.

Suggestion:
=========

If the problematic computer is not a member of the domain, I would like to
suggest that you first add it into the current domain with domain admins'
credential. Then, you may test if the issue will be re-occur.

If the problematic computer is a member of the domain, I would like to
suggest that you logon the computer with domain admins' credential. Then,
you may test if the issue will be re-occur.

Hope all the information will be helpful.

Thanks.

David Shen
Microsoft Online Partner Support

v-dashen
Thu Apr 03 05:11:21 PDT 2008

Hello Brain,

We wanted to see if the information provided was helpful. Please keep us
posted on your progress and let us know if you have any additional
questions or concerns.

We are looking forward to your response.

David Shen
Microsoft Online Partner Support