diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index f38927840..5f68f3b72 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,8 @@
+2008-05-22  Corinna Vinschen  <corinna@vinschen.de>
+
+	* grp.cc (internal_getgroups): Don't add deny-only groups to the group
+	list.
+
 2008-05-22  Corinna Vinschen  <corinna@vinschen.de>
 
 	* cygtls.h (struct san): Add two int values to store the current
diff --git a/winsup/cygwin/grp.cc b/winsup/cygwin/grp.cc
index e9e657d88..64423d8fa 100644
--- a/winsup/cygwin/grp.cc
+++ b/winsup/cygwin/grp.cc
@@ -381,8 +381,10 @@ internal_getgroups (int gidsetsize, __gid32_t *grouplist, cygpsid * srchsid)
 		for (int gidx = 0; (gr = internal_getgrent (gidx)); ++gidx)
 		  if (sid.getfromgr (gr))
 		    for (DWORD pg = 0; pg < groups->GroupCount; ++pg)
-		      if (sid == groups->Groups[pg].Sid &&
-			  sid != well_known_world_sid)
+		      if (sid == groups->Groups[pg].Sid
+			  && !(groups->Groups[pg].Attributes
+			       & SE_GROUP_USE_FOR_DENY_ONLY)
+			  && sid != well_known_world_sid)
 			{
 			  if (cnt < gidsetsize)
 			    grouplist[cnt] = gr->gr_gid;