Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a SBS/Win7 domain, what can a domain adminstrator do?, in summary?

share|improve this question
up vote 1 down vote accepted

In addition to managing the servers, when a workstation joins a Domain, the Domain Administrators Global group is automatically added to the Administrators Local Group, so it theory, a member of Domain admins has administrative privileges on all workstations in the domain.

share|improve this answer

Domain administrators have complete control over the entire Active Directory domain. This gives them full local administrator rights on all workstations in the domain, and gives them administrative rights on the server as well. This means they can log into a domain controller server (regular users cannot), they can modify other domain users, change group policies, distribute software packages, manage updates, install and remove services on servers, etc.

share|improve this answer
What is the "domain controller server"? – CJ7 Jun 9 '10 at 5:00
If you have SBS, then that machine is your domain controller. The DC is the server which maintains the list of users and computers within the domain. – Stephen Jennings Jun 9 '10 at 5:08

Basically, by default a domain administrator can do anything on computers within the domain. This can include any or all of the following:

Administer domain users and computers: Domain admins have the ability to add and remove users and computers from the domain. With SBS, you should be doing this from the Windows SBS Console so it can set up various other services such as Exchange.

Local administration: The domain's "Domain Admins" group is added to the local Administrators group on every server and workstation added to the domain. Therefore, a member of Domain Admins is an Administrator over every computer joined to the domain. This means they are also responsible for configuring services such as Exchange Server, IIS, SharePoint, SQL Server, etc. (or delegating responsibility for configuring these services).

Group Policy: Domain admins can create group policies and add them to OUs. This allows centralized management of user rights and computer settings. Group policy can control things such as user logon rights, access to programs, and the ability of users to change certain settings. Group policy can also manage installation of software on domain computers and enable automatic updating.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .