This article has been archived. It is offered "as is" and will no longer be updated.
When you try to add a security principal, such as a user or a group, from one domain to a group that is located in a separate trusted domain, the addition of that security principal may be unsuccessful and the Foreign Principal Object (FPO) that is created during the operation to represent this security principal between the two trusts may become corrupted.
This behavior may occur if you have installed previous versions of any of the hotfixes that are described in the "More Information" section of this article.
To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to Obtain the Latest Windows 2000 Service Pack
To work around this problem, remove the previous version of the hotfix, and then reinstall the new updated version.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Microsoft Windows 2000 Service Pack 4.
When you add a security principal (for example, a user or group) from a particular domain to a group that belongs to another trusted domain, the directory service creates a Foreign Principal Object (FPO) that represents this security principal in the trusted domain to which you want to add it. The versions of the Ntdsa.dll file (versions 5.0.2195.5886 to 5.0.2195.6043) that are installed when you apply previous versions of the hotfixes that are listed in the following Microsoft Knowledge Base articles introduce an incorrect behavior. The FPO that is created when you add security principals to a group that is in a trusted domain may be created without a GUID. This behavior may cause the addition of that security principal to the group to be unsuccessful, and the created FPO to be corrupted.
The hotfixes that are described in the following Microsoft Knowledge Base articles have been updated to include the latest version of the Ntdsa.dll file. If you have installed a previous version of any of these hotfixes, and if your Windows 2000-based network uses multiple domains, remove the previous version of the hotfix and then update your computer with the new updated version of the hotfix.
327825 New Resolution for Problems That Occur When Users Belong to Many Groups
290816 Underscore in a Network Resource Name for Windows 2000 Cluster Could Not Be Created
304229 16-Bit OLE Servers Started from 16-Bit Programs Create Extra VDMs in Terminal Server Sessions
313494 Microsoft Cryptography API May Not Work If the Default CSP Has Been Set Incorrectly
314446 HasMasterNCs Attributes for Server Objects in the Configuration Container May Become Damaged
Microsoft Windows 2000 Professional Edition, Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server, Microsoft Windows XP Home Edition, Microsoft Windows XP Professional, Microsoft Windows NT Server 4.0 Standard Edition, Microsoft Windows NT Workstation 4.0 Developer Edition