secedit can not import templates with IIS Virtual Accounts specified

platform: win2008r2 sp1 64bit

my task modify existing local security policy via script add , remove iis apppool identities (using virtual accounts in win2008r2).

if add users policy via local security policy administrative tool, , export policy via secedit.exe, result like

seauditprivilege = *s-1-5-19,*s-1-5-20,*s-1-5-82-1036420768-1044797643-1061213386-2937092688-4282445334,defaultapppool

note user account listed username, , not sid.

if create security template using security template mmc snap-in, , save .inf, result same, user saved 'defaultapppool'

so both tools, treat type of account same.  and should noted, there no problem adding/removing account via local security policy tool under administrator tools.

but attempt import policy via secedit iis application pool account names in file result in errors.

using secedit.exe /configure /db secedit.sdb /cfg c:\test.inf

in scesrv log say:

configure defaultapppool

error 1332: no mapping between account names , security ids done.

and when open local security policy tool, account 'defaultapppool' not listed in polices longer.

i've tried adding account via sid manually modifying inf file , adding in *s-blah-blah

doing that, can names show in local security policy tool - there appears inconsistency tool error if try edit policy leading entries missing.

it appears secedit /configure option refuses accept virtual accounts

if repeat same tests normal local user account, tool update policy (but still complain in log defaultapppool on other existing entries)

turns out bug in windows.

hotfix available at http://support.microsoft.com/kb/2411938

Windows Server  >  Security