Administrators vs Debugger Users

[Michael Rucker]

After setting up a system running Windows XP Pro with the user set to be a
member of the Administrators group, that spontaneously changes so the user
is
a member of the "Debugger Users" group. I wonder if anyone else has come
across this, and if he knows why it occurs. It happens quite a bit and I'm
not sure what is going on. Thanks!

 

[Steven L Umbach]

Where are you seeing this "Debugger Users" group?

Steve

 

[Michael Rucker]

Local Users and Groups

Where are you seeing this "Debugger Users" group?

Steve

 

[Steven L Umbach]

Is the computer in question part of an Active Directory domain? Is the user
still a member of the administrators group when this happens? There is no
default group called "Debugger Users" group in Windows XP though an
administrator could have created that group or renamed another group to that
name.

Steve

 

[Colin Nash [MVP]]

Is the computer in question part of an Active Directory domain? Is the
user still a member of the administrators group when this happens? There
is no default group called "Debugger Users" group in Windows XP though an
administrator could have created that group or renamed another group to
that name.

Steve

The group is created when you install Visual Studio.

"By default, installing Visual Studio .NET or the remote debugging
components adds you to the Debugger Users group, which enables you to
remotely access debugging components on other machines."

http://msdn.microsoft.com/library/d...ry/en-us/vsdebug/html/vxtskInstallingDCOM.asp

 

[Steven L Umbach]

Thanks for that info. Most likely that would explain the behaviour for the
OP.

Steve

 

[Michael Rucker]

Yes this system is part of of an AD Domian
Yes they are still members of Administrators

On all of these machines Visual Studio.NET is NOT installed.

Colin - please elaborate on your comment. Even if it was installed, how does
the group membership get changed from Administrators to Debugger Users? That
is the mystery.

Thank you.

 

[Steven L Umbach]

Since they are part of an Active Directory domain I would expect that Group
Policy Restricted Groups is causing the group membership to change. You
could try running rsop.msc on one of the computers to see if it shows that
Restricted Groups is being used and what Group Policy is applying it. The
link below explains how Restricted Groups works. If you enable auditing of
account management on the affected computers and see that group membership
was changed by "system" that would also indicate Group Policy Restricted
Groups or possibly a Group Policy startup script.

Steve

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

 

[Michael Rucker]

Thanks! I'll take a look at this.

Since they are part of an Active Directory domain I would expect that
Group Policy Restricted Groups is causing the group membership to change.
You could try running rsop.msc on one of the computers to see if it shows
that Restricted Groups is being used and what Group Policy is applying it.
The link below explains how Restricted Groups works. If you enable
auditing of account management on the affected computers and see that
group membership was changed by "system" that would also indicate Group
Policy Restricted Groups or possibly a Group Policy startup script.

Steve

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html