-1

For computers that aren't on a domain, Standard and Administrator accounts are very clear-cut. Standard accounts can't do administrator functions (without elevating if UAC is on), and administrator accounts can,

However, for computers joined to an Active Directory domain, the distinction seems much murkier. Some users may have some administrator permissions, while others may not. Some users may be able to do certain administrative tasks, while others may not, etc...

How is the distinction clearly defined? If an account has even some administrative rights, is it an Administrator? And if it doesn't have full rights, is it a Standard Account?

And what about Local Administrators vs. Domain Administrators?

Also, for instance, what about users with access to an administrative command prompt. They can make any change on their local machine, but they cannot make changes to their own user account, such as making their-self an administrator, unless they have been delegated that right. But it seems that it doesn't matter much

closed as too broad by LPChip, Ƭᴇcʜιᴇ007, Ramhound, Xavierjazz, Dave Jan 5 '17 at 8:34

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Your question basically says: "Please explain Active Directory to me" which is too broad. In a nutshell, aside of giving someone administrative roles, one can be given rights. If this right is for performing an administrative task, then they can do that without triggering an UAC. Its similar as to having a hotel with many doors. Each door has a padlock and in order to enter you must enter your code. Your code only opens some of the doors, not all. Which doors can open depends on what rights you have. An administrator would be a template where all these rights are predefined. – LPChip Jan 4 '17 at 13:33
  • "How is the distinction clearly defined?" It's not. – Ƭᴇcʜιᴇ007 Jan 4 '17 at 13:54
  • "And what about Local Administrators vs. Domain Administrators?" - What about them? A local Administrator can only change things that are NOT configured by the Domain Administrator (i.e. a Group Policy). "They can make any change on their local machine" - This is false. – Ramhound Jan 4 '17 at 15:43
  • @Ramhound Correct me if I am wrong, but Local Administrators (those with local administrator rights only, like on a non-domain joined machine) have full rights only over their machine - i.e. they can't change someone else's password or create a new domain or something – InterLinked Jan 4 '17 at 15:45
1

I wouldn't say that the distinction is "murkier", you just have much more granular control.

The domain admin is the absolute super user, he can do anything. Especially in larger organizations, you might want to delegate certain administrative rights without making everyone a domain admin. For example, you might define one or two people in a large department that have the right to reset passwords for their own team members so that these requests don't have to go through IT support. But even within the IT department itself you might want to have one person being responsible for the management of the internet server. This person does not need to have any rights connected to (internal) user management.

In short, you can set up a domain using very simple terminology such as "Admin" and "Standard Users", just as you would do on single computers. But most often you'll want to make use of the better control possibilities.

As for your other question, I'll refer you to: https://serverfault.com/questions/174200/domain-admins-vs-administrators-in-windows-ad-dc

2

The distinctions are exactly the same right out of the box, but can be muddied by an Administrator as the level of available control is much more granular.

When a computer joins a Windows Server domain:

  • The "Domain Users" group is added to the local "Users" group - meaning all users get the same rights as a local user.
  • The "Domain Admins" group is added to the local "Administrators" group - meaning all domain admins become local admins of your machine.

There are a few ways that things can get more complex though:

Group Policy can be used to delegate additional permissions. Group Policy Preferences can be used to add, remove, replace or otherwise tamper with the membership of any local group (you can see your local groups by going to start > run > lusrmgr.msc and look in the "Groups" container)

Group Policy can also be used to allow certain users the rights to do things that they would not normally be able to do as a limited user such as logon as a service, Remote Desktop machines, change the system time without UAC elevation - see This Technet link for a really long list of rights that can be delegated (won't post in answer as its already really long)


Some Active Directory groups have special permissions as well. An example of this is the "Account Operators" group. Membership of this group allows a user to reset the password of other users, allows deletion/removal of a machine from the domain and a whole other list of functions - but does not allow changes that would demote/promote a domain controller, create a new domain or otherwise mess with the AD Schema. This Technet Article explains the default groups and their rights on a standard out-of-the-box domain.


There are other methods that can be used for modifying rights (powershell startup scripts to change registry rights, auto-mapping of printers, auto-install of software etc) - but to go into all of thes epossibilities would make this answer endless. If you can provide a more specific example fo the type of security and rights you are curious about or give us a scenario-based question, we can give a more targeted answer.

Not the answer you're looking for? Browse other questions tagged or ask your own question.