SID History for "Domain Users" doesn't work - Shares with permissions for "Domain Users" group are inaccessible (4282761)

Shares with permissions for "Domain Users" group are inaccessible after migration

After migration is completed and "Domain Users" group has been merged you can see that SID History is present. However, when a user is trying to access a resource you will see in his token that SID History is missing.

MS confirmed in Windows 2003 they started to filter this attribute for all "well known" groups.

For more information see this MS KB article (modified February 11 2005): http://support.microsoft.com/?id=893191

You can see eg. the same behaviour with "Domain Admins" and "Administrator" groups.

This filtering works in different way and can not be disabled like you disable SID filtering on trusts when using NETDOM utility.

Since SID History is always a temporary solution we suggest to re-permission the server which is holding resources in source domain (usually a file server), this would be the easiest way to grant access for migrated users.

Another workaround would be changing the Domain Membership of the server, this was tested in lab environment and seems to work. However the best solution would be to use a dedicated group instead of built in "Domain Users" group when sharing files.