diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 149ebbc92..2377c3416 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,8 @@
+2002-01-21  Corinna Vinschen  <corinna@vinschen.de>
+
+	* grp.cc (getgrent): Don't return default gid entry when ntsec is on.
+	* syscalls.cc (setegid): Don't set primary group in process token.
+
 2002-01-21  Christopher Faylor  <cgf@redhat.com>
 
 	* speclib: Don't use /dev/null as DLL name.  Just default to what's
diff --git a/winsup/cygwin/grp.cc b/winsup/cygwin/grp.cc
index fee420992..93af7063e 100644
--- a/winsup/cygwin/grp.cc
+++ b/winsup/cygwin/grp.cc
@@ -223,7 +223,7 @@ getgrgid (gid_t gid)
 	return group_buf + i;
     }
 
-  return default_grp;
+  return allow_ntsec ? NULL : default_grp;
 }
 
 extern "C"
diff --git a/winsup/cygwin/syscalls.cc b/winsup/cygwin/syscalls.cc
index 1111d1d7d..a8b2eb2e3 100644
--- a/winsup/cygwin/syscalls.cc
+++ b/winsup/cygwin/syscalls.cc
@@ -2102,6 +2102,7 @@ setegid (gid_t gid)
 	      return -1;
 	    }
 	  myself->gid = gid;
+#if 0	  // Setting the primary group in token here isn't foolproof enough.
 	  if (allow_ntsec)
 	    {
 	      cygsid gsid;
@@ -2123,6 +2124,7 @@ setegid (gid_t gid)
 		    }
 		}
 	    }
+#endif
 	}
     }
   else