You Cannot Add a Domain User to a Local Group in the Network Identification Wizard (309639)

SYMPTOMS

After you join a Windows 2000 Professional-based computer to a domain by using the Network Identification Wizard, you may find that you cannot add a domain user to a local group on the computer. When you try to do so, you may receive an "Access Denied" error message.

CAUSE

This problem may occur if both of the following conditions are true:

In the Network Identification Wizard, you join a Windows 2000-based computer to a domain, and then you add a domain user to a local group. You do not restart the computer after you join the computer to the domain and before you add the user to the group.
When the user account is added, it uses a domain controller that is different from the one that joins the computer to the domain.

The domain information that you specify when you join the computer to the domain is cached in the registry and is used after you restart the computer to join the computer to the network. However, when you use the Network Identification Wizard to add domain user accounts, the accounts are added before the computer restarts.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

WORKAROUND

To work around this problem, join the Windows 2000 Professional-based computer to the domain, restart the computer, and then add the user accounts to the user groups that you want.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack Service Pack 3.