I have a strange AD issue. Two AD users are somehow getting domain admin privileges when they are not admins. They are able to use the Administrator privileges in our network shares, for example. I have confirmed they aren't local administrators, I have confirmed they aren't a member of Administrators. When I create a file in the share with these accounts, the owner says it's owned by "Administrators". How do I stop these users from getting these admin privileges?

Edit: One user is a member of Domain Users, the other is a member of Domain Users and 'Office' security group (which is not an administrator group).

  • Sounds like you do not have your server share NTFS ACL permissions setup to lock down the files as you think you do. – Pimp Juice IT Jul 17 '17 at 3:59
  • Can you list the names of the groups that each user is a member of in AD and also list the Security Permissions on the folder that they have access to that they shouldn't? – Dave Lucre Jul 17 '17 at 4:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.