Re: Settle a Administrator's dispute

Sorry I think I misread. I wasn't saying that administrators couldn't add themselves to other groups. I was saying the original question was a moot point because both admins and domain admins (and even serv ops and others) can give themselves as much rights in the forest as they want so even if someone took some rights away from the administrator account, you didn't actually stop anything because they can just give those rights back.

Aside from that, by default, admins and domain admins have create and modify rights in the directory for the default NC of the Domain they are part of.


--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Jorge Silva wrote:
So my setence was correct?
The bultin\Admnistrators can add himselfs to other security groups.

.

Relevant Pages

  • Re: Change permissions for domain administrators group
    ... changing permissions or configurations to prevent domain admins or administrators from doing things, is just a waste of time. ... I need to change the rights for the domain administrators group. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Settle a Administrators dispute
    ... if a user is in Administrators or Domain Admins they can give themselves as much rights as they want in the forest. ... Our disagreeable admin says that if a Global Group is put into the Administrators Local Group on the DC but not in the Domain Admins Global Group, the users of the Global Group do not have the same permissions as the Administrator account -- particularly to add/modify/delete user/computer/group accounts in AD. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain Admin Share
    ... Domain Admins have special rights to the domain by default. ... Administrators only have rights to the DC. ... I believe that only the NT Domain Admins have that right by default. ... Domain Admins group to the NT Domain Admins group. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ACL Issue - Easy Question
    ... The problem is they need full rights to work on the DC because they are the ... >> either themselves or other people to the Domain Admins or Enterprise ... >> Administrators groups set of permissions. ...
    (microsoft.public.win2000.security)
  • Rush & Rushs Are Hypocrites, Was: Re: Bellyaching
    ... support his liberty and rights to bodily integrity just as much as I ... I'm saying they have a right to bodily integrity...to not having their ... And, a legally found junkie. ... See " Freedom Of Speech ". ...
    (soc.men)