FP2000: Cannot Create New Group Names That Include Colon or Forward Slash in FrontPage 2000 Server Extensions

When you set the RestrictIISUsersAndGroups environment variable in the FrontPage 2000 Server Extensions on Microsoft Windows 2000, you cannot create new group names that include either the colon (:) character or the forward slash (/) character.

This behavior occurs when the FrontPage 2000 Server Extensions use group names that contain the colon (:) or the forward slash (/) on a Microsoft Windows NT 4.0 computer that was upgraded to Windows 2000. Windows 2000 does not allow the administrator to create new group name accounts that contain the colon (:) or the forward slash (/).

NOTE: You can use group names with these characters if they existed before your Windows 2000 upgrade.

To work around this problem, create a new group name that uses an underscore (_) character in the Windows 2000 Groups instead of the colon (:) or the forward slash (/) that was used in earlier versions of Windows, as shown in the following examples:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

The FrontPage Server Extensions for Internet Information Server (IIS) use the registry setting RestrictIISUsersAndGroups to restrict a FrontPage Server Extension client from views of all the Windows NT user and group accounts when they modify Web permissions.

To modify Web permissions in the FrontPage Server Extensions client, follow these steps:

1. Open a Web page in FrontPage Server Extensions.
2. On the Tools, menu, click the Security tab, and then click Permissions.
3. Add users and groups to FrontPage Web Permissions.

NOTE: As a security benefit, customers cannot see a listing of all the user accounts on the server for large Web hosting companies.

FrontPage Server Extensions require that a local group exists to meet a specific naming convention requirement. The user accounts that you add to this specially named group are listed in the FrontPage Permissions dialog box on the server.

FrontPage Server Extensions on Windows 2000 search for a group name that contains either the colon (:) or the forward slash (/). This allows the server to locate and use naming conventions that existed before an upgrade to Windows 2000. If a group name that does not contain either the colon (:) or the forward slash (/) is not found, FrontPage Server Extensions then search for a group name that contains the underscore (_) character.

FrontPage Server Extensions do not upgrade the naming structure on pre-existing group names, as explained in the following examples:

• If a user has a group name that contains the colon (:) or the forward slash (/), and then the user is upgraded to Windows 2000, the group name exists with the original name on both Windows 2000 and Windows NT 4.0.
• Windows 2000 accepts the colon (:) or the forward slash (/) as if these characters were created before the upgrade.

NOTE: On a new installation of Windows 2000, the following characters are restricted from group naming: