SAM database behavior on user group updates

[Guest]

Archived from groups: microsoft.public.windowsnt.domain (More info?)

Hi all that's familiar with the Windows SAM database,

Here's what I did:
1. create a new user "abc", member of "Users".
2. Added "abc" to be a member of "Administrators".
3. Added "abc" to be a member of "Power Users".

What I saw in the SAM:
4. For step 2, user abc's key under SAM\Domains\Account\Users got
changed.
5. For step 3, the key SAM\Domains\Builtin\Aliases got changed, but
nothing else.

Questions:
1. Why are there different behaviors between the same type of user
account modification? I mean, I expected abc's key to change for
adding Power Users group as well, since I am changing the property of
"abc".

2. What other gotchas like this are any of you aware of? Or is there
a good place where things like this are documented?

Thanks a lot!
Anne

 

[Guest]

Archived from groups: microsoft.public.windowsnt.domain (More info?)

Hi Anne,

I am a bit confused by number 3 because the "power users"
group is a built-in local group for standalone servers and
workstations you won't find the "power users" group in
user manager for domains. I apologize if you are referring
the local groups on a workstation or member server.

Having said that the two groups are quite different. The
"power users" group is quite limited compared to the
local "administrator" group which has full control.

"ayeh" <ayeh18@hotmail.com> wrote in message
> Hi all that's familiar with the Windows SAM database,
>
> Here's what I did:
> 1. create a new user "abc", member of "Users".
> 2. Added "abc" to be a member of "Administrators".
> 3. Added "abc" to be a member of "Power Users".
>
> What I saw in the SAM:
> 4. For step 2, user abc's key under SAM\Domains\Account\Users got
> changed.
> 5. For step 3, the key SAM\Domains\Builtin\Aliases got changed, but
> nothing else.
>
> Questions:
> 1. Why are there different behaviors between the same type of user
> account modification? I mean, I expected abc's key to change for
> adding Power Users group as well, since I am changing the property of
> "abc".
>
> 2. What other gotchas like this are any of you aware of? Or is there
> a good place where things like this are documented?