Videos
Hey everyone,
I need some clarification. I've been reading Microsoft's docs regarding the securing of the Administrators group in AD after discovering some serious permissions issues in our AD environment. Anyway, Microsoft recommends that no users/groups be made a part of the built-in Administrators group in AD, except for MAYBE the Administrator account.
Here's my dilemma: should the Domain Admins group be added to the Administrators group? How do I create/edit GPOs w/o having Domain Admins be a part of the Administrators group?
I understand having DA-* accounts just to access DCs, and only when necessary, but how do I resolve the GPO issue? Does everyone else just set it and forget it?
Thank you
Before a Domain Controller is promoted to that role, it is a simple workgroup (standalone) server and has a local Administrator account and a local Administrators group. When you create a domain, those accounts don't go away; they're incorporated into the domain as the domain Administrator account and the domain builtin\Administrators group.
The builtin\Administrators group has Administrative access to the Domain Controllers, but is not automatically granted administrative access to all computers within the domain, whereas Domain Admins are.
The domain admins group, and the AD builtin\Adminstrators group (not the local admin group on clients) effectively grant users in them the same rights, however there are some subtle differences:
- builtin\administrators is a domain local group, where as domain admins is a global group
- Domain admins are a memeber of builtin\administrators
- Domain admins are a member of the local admins group on each client pc
- The builtin\administrators group is there to provide backwards compatibility with pre-AD systems
Can anyone explain how on earth this happened? A user on one of my groups made himself admin! I am the only other admin on there.