Adding an Invalid ACE to an ACL in ADSI Does Not Return an Error

• Microsoft Internet Information Server version 4.0
• Microsoft Windows NT Server version 4.0, Terminal Server Edition
• Microsoft Active Directory Service Interfaces, version 2.5

SYMPTOMS

If you use an invalid name in an Access Control Entry (ACE) and then add it to an Access Control List (ACL), no error is returned.

You can add the new ACL to the Security Descriptor, and then add the Security Descriptor back to the property "AdminACL" in the metabase and call SetInfo. No error is returned from any of the function calls.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. For additional information, please see the following article in the Microsoft Knowledge Base:

Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

STATUS

Microsoft has confirmed this to be a problem in Internet Information Server version 4.0. This problem was first corrected in Windows NT 4.0 Service Pack 4.0 and Windows NT Server 4.0, Terminal Server Edition Service Pack 4.

Additional query words:

Keywords : NT4SP4Fix kbADSI prodNT4OP kbiis400
Version : winnt:2.5,4.0
Platform : winnt
Issue type : kbbug