Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

Le résumé des résultats de stratégie de groupe indique que le DC est membre de « BUILTIN\Administrators »

ayi

Whenever I run le Group Policy Result wizard et select a Domain Controller as le target computer, le summary shows BUILTIN\Administrators in le list of "Security Group Membership quand Group Policy was applied" under Computer Configuration, as illustrated below:

(Domain, user et computer name left out)

Since Domain Controllers are pas a member of Administrators (at least pas depuis what I can see in ADUC), mon question is simply, why?

Are Domain Controllers actually members of le Administrators group, ou is GPResults wrong (and why)?

ayi

Yes, you are seeing that correctly.

Let's do an experiment.

Grab psexec depuis Sysinternals. Transfer it to to votre domain controller.

Run psexec -s -i cmd.exe on votre domain controller.

Now in votre nouveau command prompt, type whoami et whoami /groups. Vous allez see that you are now le SYSTEM account on votre domain controller (aka DC01$) et that you do indeed belong to le Builtin\Administrators group.

Those builtin groups are shared among domain controllers. So voici something neat:

Type start \\DC02\c$ depuis votre command prompt. It should launch Windows Explorer on votre autre domain controller parce que you (DC01$) are aussi an administrator of that DC as well!

Domain controllers do pas have a local SAM in le même way that regular Windows machines do. (Well they do mais it is seulement used in restore mode.) They tous share le AD Builtin groups, et depuis a Windows system needs to be an administrator of itself in order to function, juste like tout SYSTEM account on tout autre Windows machine, that gives us le interesting side-effect that tous domain controllers end up being administrators of one another.

Edit: Cleaning up for posterity.