0

We have a Windows 2012 AD domain.

We have added some new Windows 10 Pro systems to our domain and are having an issue where when a domain user (non-admin) logs into the machine, they are automatically made a local administrator. Their account does not show up in the local Administrators group nor is there a place where we can see the user when logged in as an admin to be able to change them to a standard user.

The machines have been joined to the domain while logged in as a local admin and using the credentials of a domain admin. The first time the credentials of the domain user are used is when their account logs in for the first time after the machine was already a member of the domain.

Any ideas?

This is what it looks like when you go to settings while logged in as the user (last name and domain blacked out):

enter image description here

  • Are there other domain groups that are members of local admins? Is the user a member of one of those domain groups? – Clayton Oct 2 '17 at 14:49
  • The Local administrators group only contains 3 local accounts and the Domain Admins AD group of which the domain user is not a member of. – rubendn Oct 3 '17 at 14:11
1

Found out what the problem was.

We have a Remote Desktop Users Group that was (yikes!) added to the Domain Admins group and this caused the user to have admin rights on the machine. Luckily it was for only a short period of time and no damage was done.

  • Good thing to audit, and it's a good idea to audit that whole group. – Christopher Hostage Oct 3 '17 at 20:35

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.