Re: Domain Admin .vs Adminstrator Account

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: ptwilliams (ptw2001_at_hotmail.com)
Date: 01/23/05 

Date: Sun, 23 Jan 2005 20:31:21 -0000

However, the domain admins group is automatically added to the local
administrators group on all domain members (upon joining), which means that
the domain admins account has full administrative control over all domain
member machines. The administrator account on the other hand, isn't as
powerful in this way (just being an administrator of the domain doesn't mean
you can install software on domain members); the administrator account is
much more powerful, as Cary already stated, from a domain administrative
stand point. That is, full control over the root domain -full control over
all objects and the ability to take ownership of any object. The domain
admins group doesn't have as many rights in this way.

So, the two are quite different. The domain admins group is for
domain-member administration; the administrator account is for domain
administration -the logical and physical structure of the AD itself.

Hope this helps, 

-- 
Paul Williams
http://www.msresource.net
http://forums.msresource.net
"Cary Shultz [A.D. MVP]" <cwshultz@mvps.org> wrote in message 
news:O0AVDgYAFHA.3336@TK2MSFTNGP11.phx.gbl...
Domain Admins, which by default contains the Administrator Account, has a
lot of access to that Domain.  Pretty much everything.  But not entirely
everything.
The Administrator account, on the other hand, is a member of the Domain
Admins, Enterprise Admins and Schema Admins ( assuming that we are talking
about a single domain / tree / forest ).  As you can see, it is much more
powerful through the group membership.
Does that answer your question.
-- 
Cary W. Shultz
Roanoke, VA  24014
Microsoft Active Directory MVP
http://www.activedirectory-win2000.com
http://www.grouppolicy-win2000.com
"John" <John@discussions.microsoft.com> wrote in message
news:2A0A3B76-C614-43BB-BAD3-79DA274B5DD9@microsoft.com...
> Are there any diiferences between the accouts in the Domain Admin group
> and
> the Administrator account as far as access & permissions?
>
> Thanks

Relevant Pages

  • Re: Domain Admin .vs Adminstrator Account
    ... THE Administrator account is the initial or default ... > However, the domain admins group is automatically added to the local> administrators group on all domain members, which means that> the domain admins account has full administrative control over all domain> member machines. ... The administrator account on the other hand, isn't as> powerful in this way (just being an administrator of the domain doesn't mean> you can install software on domain members); the administrator account is> much more powerful, as Cary already stated, from a domain administrative> stand point. ...
    (microsoft.public.win2000.active_directory)
  • Re: How to secure the Administrator account?
    ... Go to the security properties of the administrator account in Active Directory ... everyone, domain admins, etc. Add the administrator account with full control and ... > with who you make an administrator, use OU's to delegate authority as you ...
    (microsoft.public.win2000.security)
  • Re: Admining NT4.0 from AD
    ... The NT4 Domain Admins is a global group and can only contain users from ... If you want the migrated user to be an administrator of ... How do we make the domain admins group in the AD ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain administration
    ... My personnal account is created in a.x.local with domain admins privilege. ... Whe i log into b.x.local with the administrator account, ... my account in the domain admins group. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Can not log on to domain controller remotely or locally.
    ... I did run the command to verify I am in the Domain Admins group and I ... Right now we have my account and an Administrator account that are both ...
    (microsoft.public.windows.server.active_directory)