Cannot See Universal Group in ADUC Windows Server 2003

Symptom

Cannot see memberships of Universal Groups from other domains when viewing a user objects on Domain controllers or XP machines in the ADUC (Active Directory Users and Computers)

Only the universal groups that reside in the local domain are shown. If the user also belongs to universal groups that do not reside on the local domain, these universal groups do not appear in the Membership tab of the user's Properties dialog box.

How to solve?

This is a bug and Windows come out with the hotfix

This hotfix (833883) was part of service packs that are already installed:

Server 2003 SP1 List of updates: http://support.microsoft.com/kb/824721

XP SP 2 List of updates: http://support.microsoft.com/kb/811113/

Important You must configure the corresponding registry key before you apply this hotfix.

To apply this hotfix, follow these steps:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. In Registry Editor, make sure that the following registry subkey exists:
   HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Directory UI
   If this subkey does not exist, follow these steps to create it manually:
   1. Locate and then click the following registry subkey:
      HKEY_CURRENT_USER\Software\Policies\Microsoft
   2. Click New, and then click Key.
   3. Type Windows to name the new subkey.
   4. Right-click Windows, click New, and then click Key.
   5. Type Directory UI to name the new subkey.
   6. Right-click Directory UI, click New, and then click DWORD Value.
   7. Type AlwaysShowExternalGroups to name the new entry.
   8. Double-click AlwaysShowExternalGroups.
   9. In the Edit DWORD Value dialog box, type 1, and then click OK.
3. After you have configured the registry subkeys and the registry entry, double-click the WindowsServer2003-KB833883-xxx-ENU.exe hotfix file, and then follow the instructions that appear on the screen.
4. Restart the computer.

See http://support.microsoft.com/kb/833883/en-us for more information