We have a Windows 2012 AD domain.

We have added some new Windows 10 Pro systems to our domain and are having an issue where when a domain user (non-admin) logs into the machine, they are automatically made a local administrator. Their account does not show up in the local Administrators group nor is there a place where we can see the user when logged in as an admin to be able to change them to a standard user.

The machines have been joined to the domain while logged in as a local admin and using the credentials of a domain admin. The first time the credentials of the domain user are used is when their account logs in for the first time after the machine was already a member of the domain.

Any ideas?

This is what it looks like when you go to settings while logged in as the user (last name and domain blacked out):

enter image description here

  • Are there other domain groups that are members of local admins? Is the user a member of one of those domain groups?
    – Clayton
    Commented Oct 2, 2017 at 14:49
  • The Local administrators group only contains 3 local accounts and the Domain Admins AD group of which the domain user is not a member of.
    – rubendn
    Commented Oct 3, 2017 at 14:11

1 Answer 1


Found out what the problem was.

We have a Remote Desktop Users Group that was (yikes!) added to the Domain Admins group and this caused the user to have admin rights on the machine. Luckily it was for only a short period of time and no damage was done.

  • Good thing to audit, and it's a good idea to audit that whole group. Commented Oct 3, 2017 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .