3

My question is ...

How do I grant domain admins the same rights at the local built in account "Administrator" when I add a new server to the domain to avoid domain admins having to constantly escalate permissions beyond what they seem to have?

EDIT:

This seems to be causing some confusion so ...

I have a domain, with a domain admins group of which I am a member. I have a new server, just joined the domain, and on that server I can login because the local group "Administrators" has member "Domain Admins".

So I as a domain admin on this server am also considered to be a local Admin too.

Now lets say I want to install a new applciation on the server and this requires admin rights.

I right click the installer, I then select "Run as Administrator" and get the usual UAC dialog pop up.

I put MY credentials in there (from my domain account, the same credentials I used to login to the server with) ... and it rejects those credentials with the validation message ... "The requested operation requires elevation".

So my question is ...

Why are my domain administrator credentials not enough to allow me to act as a local administrator on the box when I am in the Domain Admins group which is a member of the local Administrators group?

Instead I have to "elevate" my permissions to the account named "Administrator" on the local machine before my Account is granted the rights to do the install.

|improve this question
  • It's all because "local Administrators" still run with a standard user token until you specifically elevate the permissions (which, upon confirmation, will grant the full administrator action to run as desired). – Kinnectus Jun 14 '17 at 11:38
  • Did you try to alter the UAC settings ? – Overmind Jun 14 '17 at 11:39
  • FYI the domain admins group is a member of local admins by default. No need to add the user. – Bob Jun 14 '17 at 11:44
  • "Things like managing users and groups requires me to do "run as administrator => Computer Management"." - Yes, this is by design. – Ramhound Jun 14 '17 at 11:49
  • I think you guys are missing what I am trying to say ... I don't mind the fact that escalation must take place, what I have issue with is that my Domain Admin account is not enough when that happens. I MUST provide only the local administrator accounts credentials, no domain admin account is good enough. – War Jun 14 '17 at 11:53
2

Microsoft TechNet article https://technet.microsoft.com/en-us/library/dd759094(v=ws.11).aspx provides a perfect answer for this; and it's to do with the fact that even "local Administrator" accounts still run with "standard user" tokens for normal day-to-day activity.

What does "running with a full administrator token" or "running with an elevated token" mean in User Account Control?

Applies To: Windows Server 2008 R2

Applications normally run with the level of access granted in a standard user access token, even if the applications are started by a user that is a member of the local Administrators group. "Running with a full administrator access token," sometimes referred to as "running with an elevated access token," means that an application is allowed to use the user's full administrator access token, which includes the administrator security identifiers (SIDs).

Note The user must be logged on as a local administrator or be able to provide credentials for a member of the local Administrators group.

Side note: Although the article applies to Server 2008 R2 the same would also apply to all modern Windows client and server versions.

|improve this answer
  • That answer would make sense if when the UAC dialog pops up I could put in my own Domain Admin credentials but in such cases I can't, I have to put in the Local Admin account credentials. – War Jun 14 '17 at 11:51
  • What happens if you put your domain admin credentials in the form domain\username for the username (regardless of whether it already has your domain under the password input)? – Kinnectus Jun 14 '17 at 12:03
  • It doesn't work ... it re-presents me with the same dialog, hense my confusion :( I get presented with the validation message "The requested operation requires elevation". – War Jun 14 '17 at 12:05
  • This didn't solve my problem but I don't like having loose ends. I re-created my domain admin account and re-added the new account to the domain admins group in the end. – War Jun 15 '17 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.