This article was previously published under Q277752
This article has been archived. It is offered "as is" and will no longer be updated.
This article discusses how some security identifiers (SIDs) for well-known built-in groups are unresolved when you modify the user rights assignment in the Default Domain Controllers Group Policy object.
The preceding behavior is expected if the built-in group does not exist on the computer where the Group Policy snap-in is run.
As an example, the following SIDs can be unresolved when you modify Domain Group Policy from a Microsoft Windows 2000 Professional-based workstation because these built-in groups do not exist locally: