Administrator GPO?

[Koldov]

Hi All,

 

Bit of a nooby question here, but what the heck we're all friends right?

 

I have a (very) basic grasp of AD and GPO's but I'm just throwing this out there to save my brain....

 

In AD you have your USERS and COMPUTERS, right? This is somewhat mirrored by the structure of the our GPO management screen (as in when I add an OU in AD then it shows up in the GPO screen)...

 

The standard 'BUILT-IN', 'COMPUTERS' and 'USERS' OU's do not however appear there by default. I only ask because I signed on to the server as 'THE' administrator yesterday and realised a particular (IE homepage) GPO had not applied. After some digging in AD I realised that 'THE' administrator account does not actually reside in an our OU named ADMINISTRATORS, because that shows in AD and has the GPO applied. It actually sits in the default USERS OU which only has the Default Domain Policy applied as it does not appear in the GPO management screen to apply any other GPO's to it.

 

So my questions (and I do know I should not be loggin-on as 'THE' administrator....

 

Can I just drag and drop 'THE' administrator account from the default 'USERS' OU to our administrators OU, to have our administrator policy apply to it?

 

Is the account in the default USERS OU because you are not supposed to do this or log-on with it, or 'muck about' with it as applying GPO's incorrectly may cause other issues or lock it out?

 

Kol.

[localzuk]

It is highly inadvisable to move the default domain admin account - as it means you can break things. Realistically, you shouldn't use it at all for day to day stuff either.

[sparkeh]

My advice is to leave well alone.

Create a new domain admin account and plonk it in whatever OU you like and use that account.

[Koldov]

Realistically, you shouldn't use it at all for day to day stuff either.

 

I have read that numerous times, but I just can't bring myself to change for some reason (like I might break something if I don't sign on as the administrator)...

 

This is how I was shown to log-on to the server when I started a couple of years back, it's what the previous tech did and what the senior tech that was training me did...

 

Kol.

[fairm010]

I 'copied' the admin account and used my own credentials then moved it to its own OU. the Administrator account is locked in a safe, never used but for emergencies (I forget my password)

[penfold]

As others have said, create a new admin account. And if you are a bit nervous about moving/dragging accounts from 1 OU to another, you can right click and select "move" to move the object into another OU. It allows you to select the OU and can cut down the opportunity to accidentally drag the object into the wrong OU.