Re: Domain Admin .vs Adminstrator Account

From: Herb Martin (news_at_LearnQuick.com)
Date: 01/23/05

  • Next message: Josh Davis: "Re: 2003 AD intergration with local Administrator Accounts on xp/win2k" 
    Date: Sun, 23 Jan 2005 15:33:18 -0600

    You guys are right so maybe the real key is in the
    way they are (to be) used....

    Domain Admins, a GLOBAL, group has no direct
    permissions or rights by default, but derives its
    privileges by being added to other (Local) groups
    on the Domain or the individual Computers.

    It is a "collection of users" (who should typically
    have administrative access to something.)

    Admistrators (a LOCAL group) on either the Domain
    or Computer, receives the actual privileges (directly)
    and by including others provides that access to
    individual users.

    Administrators is a collection of privileges (to various
    resources.)

    THE Administrator account is the initial or default
    administrator of either a Domain or a Computer
    (because someone needs that role.) 

    -- 
Herb Martin
"ptwilliams" <ptw2001@hotmail.com> wrote in message
news:uOPdBqYAFHA.600@TK2MSFTNGP09.phx.gbl...
> However, the domain admins group is automatically added to the local
> administrators group on all domain members (upon joining), which means
that
> the domain admins account has full administrative control over all domain
> member machines.  The administrator account on the other hand, isn't as
> powerful in this way (just being an administrator of the domain doesn't
mean
> you can install software on domain members); the administrator account is
> much more powerful, as Cary already stated, from a domain administrative
> stand point.  That is, full control over the root domain -full control
over
> all objects and the ability to take ownership of any object.  The domain
> admins group doesn't have as many rights in this way.
>
> So, the two are quite different.  The domain admins group is for
> domain-member administration; the administrator account is for domain
> administration -the logical and physical structure of the AD itself.
>
> Hope this helps,
>
> -- 
>
> Paul Williams
>
> http://www.msresource.net
> http://forums.msresource.net
>
>
> "Cary Shultz [A.D. MVP]" <cwshultz@mvps.org> wrote in message
> news:O0AVDgYAFHA.3336@TK2MSFTNGP11.phx.gbl...
> Domain Admins, which by default contains the Administrator Account, has a
> lot of access to that Domain.  Pretty much everything.  But not entirely
> everything.
>
> The Administrator account, on the other hand, is a member of the Domain
> Admins, Enterprise Admins and Schema Admins ( assuming that we are talking
> about a single domain / tree / forest ).  As you can see, it is much more
> powerful through the group membership.
>
> Does that answer your question.
>
> -- 
> Cary W. Shultz
> Roanoke, VA  24014
> Microsoft Active Directory MVP
>
> http://www.activedirectory-win2000.com
> http://www.grouppolicy-win2000.com
>
>
>
> "John" <John@discussions.microsoft.com> wrote in message
> news:2A0A3B76-C614-43BB-BAD3-79DA274B5DD9@microsoft.com...
> > Are there any diiferences between the accouts in the Domain Admin group
> > and
> > the Administrator account as far as access & permissions?
> >
> > Thanks
>
>
>
  • Next message: Josh Davis: "Re: 2003 AD intergration with local Administrator Accounts on xp/win2k"

    Relevant Pages

    • Re: Domain Admin .vs Adminstrator Account
      ... the domain admins group is automatically added to the local ... The administrator account on the other hand, ...
      (microsoft.public.win2000.active_directory)
    • Re: How to change domain administrator to limited/restricted user?
      ... If it's "a" domain administrator, then remove the user from the ... If your users are members of the "Domain Admins" group then you have a big ... local workstation administrators group. ...
      (microsoft.public.windows.server.sbs)
    • Re: Roaming Profile problem
      ... Unless you're playing with Restricted groups policy or any other scripts, generally Domain Admins are members of local Administrators in all machines in the domain check that. ... I did log on as the domain administrator not the local admin. ... You're logged on with the account that refer to the profile to be copied. ... Logged on as test student ...
      (microsoft.public.windows.server.active_directory)
    • Re: Possible answer to domain problems
      ... that the DCPROMO process may change the policy so that only domain admins ... local administrator when running DCPROMO, so that if the Domain Admins group ... > install Office XP on it, so I started from scratch again. ...
      (microsoft.public.win2000.security)
    • Re: full sharing between domain admins
      ... mentions a determined domain administrator ultimately has ways to gain ... themselves back in local administrators group for instance. ... > to the adminsitrative share of other domain admins, ... > by adding the other domain admin accounts to the "deny ...
      (microsoft.public.win2000.security)