DOCUMENT:Q102562  23-AUG-1993  [W_NTAS]
TITLE   :Guest Account Can Create Local Groups in Untrusted Domains
PRODUCT :Microsoft Windows NT Advanced Server
PROD/VER:3.10
OPER/SYS:WINDOWS
KEYWORDS:

--------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT operating system version 3.1
 - Microsoft Windows NT Advanced Server version 3.1
--------------------------------------------------------------------

SUMMARY
=======

Any user who can run User Manager for Domains on a Windows NT Advanced
Server can create a local group for any untrusted domain in which the
Guest account is enabled.

MORE INFORMATION
================

Any user who can run User Manager for Domains on a Windows NT Advanced
Server can choose Select Domain from the User menu and enter any
domain name. If that domain has the Guest account enabled, the New
Local Group command on the User menu will not be dimmed (grayed out).

The user can then create a local group and add any accounts for the
domain into the local group. However, although the group can be
created, this group cannot be assigned permissions on the server
because file access is not available. The user can also delete this
local group because the user is the owner of the group.

Although the Delete, Rename, and Properties commands on the User menu
are available, the user will receive an "Access Denied" message when
he or she tries to use these commands.

Additional reference words: 3.10
KBCategory:
KBSubCategory: ntadsrv netsrv scrty

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Copyright Microsoft Corporation 1993.