There are three domains in our forest and I’ll call them domain A (the root of forest), B and C here. For some reason I am having some bizard security problem in both domain B and C, here are some descriptions:
When I had to modify the member of local security group (Administrators / Power Users) on workstations, what I always do is to open “Computer Management” from my own computer and connect to the destination workstation, then do the change I want to do. There was never a problem in the last 2 years since out Win2K forest was created. However recently I am getting error about access denied, the message looks like this:
“The following error occured while attempting to save properties of group Administrators on computer XXX: Access is Denied”
Of course my account is a member of Enterprise Admins and also Domain Admins of each domains, so the assumption that “My account does not have permission to make that change” has been eliminated.
After failing to do this simple task from my own workstations, I checked the member of local “Administrators” to make sure that “Domain Admins” is still there, and it is there. Then I went to the DC of each domain and tried to do it from there (logging on as domain Administrator account) and still getting the same error. However if I visit the workstation and log on as domain administrator to it, I have no problem.
This is happening to *ALL* workstations (Win2K/ XP) under domain B and C, and it happens all in a sudden, therefore I have eliminated the possibility that it is about security patch / service pack or something like that.
All services running on these two domains are working fine, there is no event log about this from the server, although each failure was logged on the workstations, that does not help me to troubleshoot at all.