Domain Admin group membership.

[edutech4schools]

I have just taken over a small primary from the Local Authority and have been looking around the server setup.I have noticed that in the Domain Admin user account they gave me, it lists lots of other DC account groups.

 

Domain/BuiltIn - Administrators

Domain/BuiltIn - Backup Operators

Domain/BuiltIn - Domain Admins

Domain/BuiltIn - Domain Users

Domain/BuiltIn - Enterprise Admins

Domain/BuiltIn - Group Policy Creator Owner

Domain/BuiltIn - Remote Desktop Users

 

I am not going to delete anything from this account for the moment, but if I create a new Domain Admin user account wouldn't simply having the Domain Admins group give me all the rest by default anyway.

Edited March 22, 2017 by edutech4schools

[Davit2005]

Domain Admins aren't Enterprise admin by default. You should only grant Enterprise Admin to a user for specific tasks such as Exchange upgrades etc.

[edutech4schools]

Thanks - What about the other groups listed, is Domain admin not already able to do backups, rdp or gpo? I am sure it can.

[Davit2005]

The key is least privileged to perform a function. You wouldn't want to make a normal end user a Domain Admin just so they can install software on a machine you'd just make them members of Administrators on the machine ONLY if absolutely necessary. If a user is required for backing up then only give them enough permission for that task and this goes for service accounts as well. Don't use a Domain Admin for LDAP lookup as it is not needed. For AD machine joins in MDT etc. create an account solely for that purpose which does not need to be Domain Admins either.

 

Take a look at Enterprise vs Domain admin but I think the rest should be all OK to leave.

 

You shouldn't really be needing to log into a client machine as Domain Admin

[MatthewL]

Looks like they have copied the Administrator account, that will have all them permissions by default.