Hi
We have an issue where by a very small percentage of clients (no more
than 30 out of 40,000) are having members removed from their local
groups. We control most of the group members locally on these clients
via restricted groups in a single GPO. We can see "policy change" and
" account management" events on these clients that show the members
being removed but we don't know by what.
We do currently have a typo in the restricted groups of this GPO
introduced by a migration table typo. This typo maps a service account
(just a local user account on the client) as if its a local group on
the client. This generates a Eventid1202 but can be explained
I've seen this article, that refers to a AD object that has been
removed being refereced in the resticted group causing a problem but
can't actually get my head round whether its relavent.
http://support.microsoft.com/kb/320099/en-us
Can anyone suggest a way of captured whats actually removing these
group members, bearing in mind that its only happening on a very small
number of clients. We already have the event tracking the removal just
don't know by what
Craig
ps, the clients do eventually fix themselves which Im assuming is
after the 16hours security settings refresh