Can an AD account be disabled from the client computer?

[Yeo695]

Can an active directory account be disabled from the client side computer running windows 7 if given local admin to the client computer? Been enabling and disabling student accounts and a just ran into a second case where I enabled an account and about a week later the account was disabled again?

 

Extra info: There are no policies or anyone else managing accounts but myself.

[ADMaster]

Hello,

To be clear I’ll say this has two answers.

Yes an account can be disabled from the client. I use a combination of RSAT / ADUC, powershell scripts, and other tools to manage accounts from my client machine every day.

 

No local admin should not have any effect on domain accounts.

I suggest that you do the following;

Review permissions of the accounts in question to see if someone has been given permission to them before.

Turn on auditing to see who / when the account was changed.

Change passwords if you suspect someone else may be using your domain admin credentials.

 

I know you said there are no policies or no one else managing accounts, but do you have any automated process that disables accounts if they are no longer in the SIS etc.

 

Cheers,