0

We have a Windows 2012 AD domain.

We have added some new Windows 10 Pro systems to our domain and are having an issue where when a domain user (non-admin) logs into the machine, they are automatically made a local administrator. Their account does not show up in the local Administrators group nor is there a place where we can see the user when logged in as an admin to be able to change them to a standard user.

The machines have been joined to the domain while logged in as a local admin and using the credentials of a domain admin. The first time the credentials of the domain user are used is when their account logs in for the first time after the machine was already a member of the domain.

Any ideas?

This is what it looks like when you go to settings while logged in as the user (last name and domain blacked out):

enter image description here

Improve this question
2
  • Are there other domain groups that are members of local admins? Is the user a member of one of those domain groups?
    – Clayton
    Oct 2, 2017 at 14:49
  • The Local administrators group only contains 3 local accounts and the Domain Admins AD group of which the domain user is not a member of.
    – rubendn
    Oct 3, 2017 at 14:11

1 Answer 1

Reset to default
1

Found out what the problem was.

We have a Remote Desktop Users Group that was (yikes!) added to the Domain Admins group and this caused the user to have admin rights on the machine. Luckily it was for only a short period of time and no damage was done.

Improve this answer
1
  • Good thing to audit, and it's a good idea to audit that whole group.
    – Christopher Hostage
    Oct 3, 2017 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.