Windows Forum

Ask something
Discussion Locked

Wierd Admin privileges

0 helpful
7 replies

by jacksolc

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

For some reason, a "normal" (non-admin) user has Local Administrator privileges. I can't figure it out. I've tried all of the obvious: group memberships (Active Directory and local machine) etc. The user is logging into an Active Directory domain. The domain local group he's logging into is not a member of any group that has been added to the local computer's Administrators group. He only has a membership in the computer's Users group. What gives?

Is there anything (token/SID/tool) that can examine more closely what privileges the logged in user has?

7 replies

by highlore

Is the problem related only to one machine or is it on every system he logs on to?

If it is on only one machine:
Did you use Ghost or other system copying program to create this machine? If you did, that could be the problem. Did you use ghostwalker to change the SID?

If that isnt the case, I should advice you to do some forensics:

Create another user account and give it the same rights as the other malicious account. If it has the same problems, it really is a group problem. If it doesnt, delete and recreate the account he is using now.

If the problem is group related (and so other people also have this same problem):

Check the groups he belongs to. Sometimes you can make a mistake and you add a group to the domain administrators or one of the other groups that give you administrator rights on the machines.

Lastly: Check your group and local policies.

by jacksolc

This is happening on a specific group of computers. I ran gpresult.exe against the machines it was happening on and the machines it was not. (Logging into both sets of machines with the same account produces the results indicated on only one set of computers.

The results show that the "Local Computer Policy" as well as the Domain policy is being applied on the machines with the odd behavior. It also shows that the logged in user is a member of the "Builtin\Administrators" group. That's the source of the problem. The working machines only show the Domain Policy being applied and the user is not a member of the Builtin Administrators group.

I don't know how this happened, but I can't seem to reverse it. Nothing in the Local Computer Policy that I can access shows the user as being a member of the Builtin Admin group. The "User Configuration" "Security Settings" section is locked out, so I can't see it.

I am willing to prevent the Local Computer Policy from being applied. How do I do that?

by shmaltz

I don't really know if you did or didn't do this yet but this is where I would start:
1. Check EVERY Group that this user is member of, both local and domain groups.
2. Check the Groups from 1 to see what group that is a member of, both local and domain.
3. Keep going to make sure that it doesn't somehow end up in the admins local group.

You can do a simple test, add your self to the local admins group, remove everybody else from the admin group including the domain groups (but not the local admin). Now have the user log on again, if the user still has these permission then something is wrong with the Group Policy, if not then there is something wrong with the group membership.
If it's the group policy then just change the machine policy right to a more restrictive one for the regulare users.

by jacksolc

Yep. I had overlooked a critical domain group membersip that was added to one group of machines' Local Administrato group, but not on the others.

by curlergirl

This *is* pretty weird, since the local group policy should be completely overridden by the domain group policy. I'm thinking that perhaps somehow the trust between the computer and the domain is corrupted. One thing to try would be to take one of the computers that is not working properly and unjoin the domain, delete the computer's domain account, and then rejoin the domain. By removing and then recreating a new account for the computer on the domain, the trust between the computer and the domain will be removed and recreated.

Hope this helps!

by jacksolc

Thanks. This would have been something to try had the problem not been resolved yet.

This discussion is closed to new replies.