Re: Settle a Administrator's dispute

Tech-Archive recommends: Fix windows errors by optimizing your registry

Then what you are seeing with the administrators group is local to your installation, it isn't an MSFT default.

As for why administrators is often labeled as a localgroup it is because it is historically manipulated by the legacy LocalGroup subset of functions in the NET API. Probably because it had the same membership rules of local groups.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


savvy95 wrote:
Joe -- I do believe he's dorked with the permissions and I looked at the permissions with a resource kit tool, acldiag and concluded that anyone who's a member of the builtin/Administrators group has full control of some some security principals but not others. In some cases the group has read only. This leads me to my first statement.

Thank you all for your input and suggestions

BTW -- if you look at the properties of the builtin/Administrators group, you will see it is called a "Local Group". I don't know why MS does this.

thanks again.

"Joe Richards [MVP]" wrote:

It is moot, if a user is in Administrators or Domain Admins they can give themselves as much rights as they want in the forest.

But anyway, you can look at the ACLs in AD to see what rights the two groups have over AD.

By default, both administrators and Domain Admins have CREATE CHILD within the domain so they could both create objects. They also, by default have WRITE PROPERTY which means they can change any attributes they want.

joe



--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


savvy95 wrote:
We have a dispute where one Admin disagrees with another 2 regarding the Administrators Local Group ON THE DOMAIN CONTROLLER. We are not talking about the group on the workstation.

I'd like confirmation that I'm correct.

Our disagreeable admin says that if a Global Group is put into the Administrators Local Group on the DC but not in the Domain Admins Global Group, the users of the Global Group do not have the same permissions as the Administrator account -- particularly to add/modify/delete user/computer/group accounts in AD.

Can you help settle this dispute.

The original problem was to give domain user accounts local administrator rights.

All help is appreciated.
.

Relevant Pages

  • Re: Administrators , power user
    ... there aren't sublevels of administrators. ... Joe Richards Microsoft MVP Windows Server Directory Services ...
    (microsoft.public.windows.server.security)
  • Re: Membership in Admin groups resets Send As permissions - Blackberry
    ... those protected groups having Send As rights. ... Why would Microsoft put a change this drastic ... it so that Administrators CANNOT use Blackberry's. ... Also, this basically forces any admin to have 2 accounts, otherwise they ...
    (microsoft.public.exchange.admin)
  • Re: Membership in Admin groups resets Send As permissions - Blackberry
    ... those protected groups having Send As rights. ... Why would Microsoft put a change this drastic ... it so that Administrators CANNOT use Blackberry's. ... Also, this basically forces any admin to have 2 accounts, otherwise they ...
    (microsoft.public.exchange.admin)
  • Re: Adding a password to a reminder?
    ... Outlook 2002, XP ProSP2. ... You need to set up multiple user accounts - but this is really no big deal, ... and set the NTFS security appropriately so that administrators & system have ... as profiles sometimes get corrupted and I ...
    (microsoft.public.outlook)
  • Re: changing passwords
    ... Joe Richards Microsoft MVP Windows Server Directory Services ... Is there a way to scan a domain looking for these accounts being used on machines?" ...
    (microsoft.public.windows.server.active_directory)