On a SBS/Win7 domain, what can a domain adminstrator do?

Question

On a SBS/Win7 domain, what can a domain adminstrator do?, in summary?

Answer 1

In addition to managing the servers, when a workstation joins a Domain, the Domain Administrators Global group is automatically added to the Administrators Local Group, so it theory, a member of Domain admins has administrative privileges on all workstations in the domain.

Answer 2

Domain administrators have complete control over the entire Active Directory domain. This gives them full local administrator rights on all workstations in the domain, and gives them administrative rights on the server as well. This means they can log into a domain controller server (regular users cannot), they can modify other domain users, change group policies, distribute software packages, manage updates, install and remove services on servers, etc.

Answer 3

Basically, by default a domain administrator can do anything on computers within the domain. This can include any or all of the following:

Administer domain users and computers: Domain admins have the ability to add and remove users and computers from the domain. With SBS, you should be doing this from the Windows SBS Console so it can set up various other services such as Exchange.

Local administration: The domain's "Domain Admins" group is added to the local Administrators group on every server and workstation added to the domain. Therefore, a member of Domain Admins is an Administrator over every computer joined to the domain. This means they are also responsible for configuring services such as Exchange Server, IIS, SharePoint, SQL Server, etc. (or delegating responsibility for configuring these services).

Group Policy: Domain admins can create group policies and add them to OUs. This allows centralized management of user rights and computer settings. Group policy can control things such as user logon rights, access to programs, and the ability of users to change certain settings. Group policy can also manage installation of software on domain computers and enable automatic updating.