AD Built-in groups only resolve on Domain Controllers, not on member servers (Windows Server 2022, 2016.

Maheswaran Shanmugavelu 20 Reputation points
2026-07-16T15:33:29.7866667+00:00

In our ABC.com Active Directory domain (forest and domain functional level: Windows Server 2016), all Domain Controllers run Windows Server 2022 with current security updates and healthy replication. From Domain Controllers, built‑in AD groups in the Builtin container (for example, A-AD _Screenshot 2026-07-16 102822.png Administrators, Backup Operators, Server Operators) resolve and can be added to the permissions without any problem.

However, from multiple domain‑joined member servers and workstations, when we use the Security tab (e.g., to add groups to NTFS/file ACLs), these same built‑in groups cannot be found by “Check Names,” even though:

Object types include Users, Groups, or Built-in security principals.

Location is set to the domain (ABC.com).

The group names are copied directly from Active Directory Users and Computers.

Non‑builtin groups such as Domain Admins and Domain Users resolve successfully from the same member systems. We have confirmed via gpresult /h that no Restricted Groups policies are configured in our core GPOs (Default Domain Policy, Default Domain Controllers Policy, Servers GPO), and the issue is reproducible across multiple member systems and admin accounts.

We are trying to understand whether this is expected behavior or a configuration issue, and what the recommended approach is to use these built‑in groups from member servers in modern AD environments.

Windows for business | Windows Server | Directory services | Active Directory
0 comments
Answer accepted by question author
Allan Solomon Mejia 9,485 Reputation points
2026-07-16T16:11:06.6433333+00:00

Hi Maheswaran,

What you're seeing is expected behavior rather than a replication or GPO issue. The groups under CN=Builtin (such as Administrators, Backup Operators, and Server Operators) are Builtin domain-local administrative groups intended primarily for administrative delegation within the domain, particularly on Domain Controllers. They are not designed to function as general-purpose resource groups across member servers. As a result, Domain Controllers can resolve these groups because they host the security database where these Builtin principals are meaningful, whereas the object picker on member servers does not consistently enumerate or resolve them for ACL assignment. This differs from groups like Domain Admins or Domain Users, which are standard Active Directory groups stored in the Users container and are expected to resolve from any domain-joined system.

For assigning NTFS, share, or application permissions, Microsoft's recommended practice is to create your own Global/Universal and Domain Local security groups (following AGDLP or AGUDLP) rather than relying on the Builtin groups. This provides predictable behavior, clearer delegation, and aligns with modern Active Directory design.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Maheswaran Shanmugavelu 20 Reputation points
    2026-07-16T16:39:11.43+00:00

    Thanks for your time. Could you please send the MS support link that says this? This will be more helpful.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.