Administrators vs Debugger Users

  • Thread starter Thread starter Michael Rucker
  • Start date Start date
M

Michael Rucker

After setting up a system running Windows XP Pro with the user set to be a
member of the Administrators group, that spontaneously changes so the user
is
a member of the "Debugger Users" group. I wonder if anyone else has come
across this, and if he knows why it occurs. It happens quite a bit and I'm
not sure what is going on. Thanks!
 
Is the computer in question part of an Active Directory domain? Is the user
still a member of the administrators group when this happens? There is no
default group called "Debugger Users" group in Windows XP though an
administrator could have created that group or renamed another group to that
name.

Steve
 
Steven L Umbach said:
Is the computer in question part of an Active Directory domain? Is the
user still a member of the administrators group when this happens? There
is no default group called "Debugger Users" group in Windows XP though an
administrator could have created that group or renamed another group to
that name.

Steve
Click to expand...


The group is created when you install Visual Studio.

"By default, installing Visual Studio .NET or the remote debugging
components adds you to the Debugger Users group, which enables you to
remotely access debugging components on other machines."

http://msdn.microsoft.com/library/d...ry/en-us/vsdebug/html/vxtskInstallingDCOM.asp
 
Thanks for that info. Most likely that would explain the behaviour for the
OP.

Steve
 
Yes this system is part of of an AD Domian
Yes they are still members of Administrators

On all of these machines Visual Studio.NET is NOT installed.

Colin - please elaborate on your comment. Even if it was installed, how does
the group membership get changed from Administrators to Debugger Users? That
is the mystery.

Thank you.
 
Since they are part of an Active Directory domain I would expect that Group
Policy Restricted Groups is causing the group membership to change. You
could try running rsop.msc on one of the computers to see if it shows that
Restricted Groups is being used and what Group Policy is applying it. The
link below explains how Restricted Groups works. If you enable auditing of
account management on the affected computers and see that group membership
was changed by "system" that would also indicate Group Policy Restricted
Groups or possibly a Group Policy startup script.

Steve

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html
 
Thanks! I'll take a look at this.

Steven L Umbach said:
Since they are part of an Active Directory domain I would expect that
Group Policy Restricted Groups is causing the group membership to change.
You could try running rsop.msc on one of the computers to see if it shows
that Restricted Groups is being used and what Group Policy is applying it.
The link below explains how Restricted Groups works. If you enable
auditing of account management on the affected computers and see that
group membership was changed by "system" that would also indicate Group
Policy Restricted Groups or possibly a Group Policy startup script.

Steve

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html
Click to expand...
 
Back
Top