Domain Admin

domain admins, can remove, add; computers, users, backup, passwords, ipscheme, just about everything. domain users is a generic account that gives the users under that group account the right to run programs and see the shares they are allowed to see. Go to your public library for more of a in depth description

Easiest way to understand what makes the "domain admin" group account powerful is:
1. Understand the concept that a user account, any account including those in the domain admin group, is the same as any other user account. An account does not havemore or less power than any other account in NT. What produces the power is the permissions and rights that are assigned to the account, or group. In other words, if you wanted to make your own "Domain Administrators" group, simply create a new group, then assign all possible user rights to the new group and presto, a new domain admin group equal in power in every way to the original.
The Domain Admin global group is added to the local administrators group on every NT box in a domain. The local admin group is assigned, by default, all possible user rights. (sometimes they're not listed but this is a function of the NT SAM database.)
2. Now, take a look at the possible user rights (User manager for domains, policies, user rights) Be sure to view all (tick the advanced box) and bear in mind that all of these rights are assigned to the local administrators group. See why an admin is so powerful? Now look at which rights are assigned to the users group (the domain users global is in this local group). See how limited they are?

Now you know the difference.

Ian

This question was auto closed due to inactivity