NetUserGetGroups Does Not Work and Generates a 1722 Error When Multiple Network Providers Are in Use (281312)

SYMPTOMS

When you try to list the groups to which a user belongs by using NetUserGetLocalGroups, it may not work, and may generate a 1722 error. A service that is running under a local-user context (for example, a local account on a Windows NT Workstation-based computer) may call NetUserGetLocalGroups to list groups a domain user belongs to. If this user has a local group that contains a global group from a trusted domain, the Application Programming Interface (API) does not work when multiple network providers are installed on the computer.

CAUSE

The user-mode API tries to connect to the domain controller (DC) from the trusted domain whose global group is stored in the user's local group. This connection does not work, and generates a STATUS_LOGON_FAILURE. The API then connects by using a null account. The problem happens when multiple providers (redirectors) are installed. The STATUS_LOGON_FAILURE error becomes masked (overwritten) by the error that is received by the next provider, STATUS_BAD_NETWORK_NAME. The error code with the highest precedence is returned to the API. Under these conditions, because both of these error codes were unlisted, the last one is passed on to the API.

RESOLUTION

Windows 2000

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

Windows NT 4.0

A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that are experiencing this specific problem.

To resolve this problem, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this fix should have the following file attributes or later:

   Date        Time              Size     File name     Platform
   -------------------------------------------------------------
   12/07/2000  03:02p            80,848   Mup.sys       i386
   12/07/2000  03:00p            142,800  Mup.sys       Alpha

WORKAROUND

To work around this problem, change the order of the network providers. To do so:

Click Start, point to Settings, and then click Control Panel.
Double-click Network and Dial-up Connections.
Click Advanced, and then click Advanced Settings.
Click the Provider Order tab.
In the Network providers list, click Microsoft Windows Network.
Click the down-arrow button to move Microsoft Windows Network to the bottom of the Print Providers tree.
Click OK, and then close the Network and Dial-up Connections dialog box.