Windows Forum

Ask something
Discussion Locked

Local Admins have Domain Admin Rights

0 helpful
9 replies

by lynn.melton

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
A domain user who is in the local admin group on a nt4 workstation can add server tools on their pc, open it and have full access to all users just like a domain administrator. Where is this enabled? (pure nt4 network)

9 replies

by gigelul

Your local Admin account must be different than Domain Admin account(password). To exclude confusion rename local admin accounts. Also check on server the content of groups. By default local admin can open domain admin tools but is not allowed forchanges.

by gigelul

In our network users don't have local accounts and all it's OK. Only Domain Admin have other account for local admin.

by lynn.melton

I am only talking one account on this one. If a ragulat domain user (not in any global groups) is added to the local admin group, that user can OPEN and MODIFY user manager (and other server tools) for domains with server tools.

by gigelul

I missunderstand somethings. You say that- a regulate domain user is added to the local admin group (ON WORKSTATION?), that user can open and modify user manager (FOR DOMAIN?) (and other server tools) for domains with server tools?
By default it is not true!
Check for some mistake in your settings!

by lynn.melton

You now understand correctly! When a regular domain user's domain account is added to the local admin group on his machine, he has full access to the domain properties with server tools! I assume it is in a setting somewhere, but that is what I needhelp with.

by gigelul

Again. You chalange me. I try to simulate this situation and I found this:
-your problem is not regardind that user is in local admin group or not.
-problem is from User Manager\Policies\User rights policies. By example you enabled for that user or a group of users.
Also check the rest of the rights options.

This discussion is closed to new replies.