Whenever [I run](http://www.virtuallyimpossible.co.uk/how-to-use-the-group-policy-results-wizard/) le [Group Policy Result wizard](http://technet.microsoft.com/en-us/library/cc780305(v=ws.10).aspx) et select a Domain Controller as le target computer, le summary shows `BUILTIN\Administrators` in le list of "Security Group Membership quand Group Policy was applied" under Computer Configuration, as illustrated below:
(Domain, user et computer name left out)
Since Domain Controllers are pas a member of Administrators (at least pas depuis what I can see in ADUC), mon question is simply, why?
Are Domain Controllers actually members of le Administrators group, ou is GPResults wrong (and why)?
Le résumé des résultats de stratégie de groupe indique que le DC est membre de « BUILTIN\Administrators »
Re: Le résumé des résultats de stratégie de groupe indique que le DC est membre de « BUILTIN\Administrators »
Yes, you are seeing that correctly.
Let's do an experiment.
Grab psexec depuis Sysinternals. Transfer it to to votre domain controller.
Run `psexec -s -i cmd.exe` on votre domain controller.
Now in votre nouveau command prompt, type `whoami` et `whoami /groups`. Vous allez see that you are now le SYSTEM account on votre domain controller (aka DC01$) et that you do indeed belong to le Builtin\Administrators group.
Those builtin groups are shared among domain controllers. So voici something neat:
Type `start \\DC02\c$` depuis votre command prompt. It should launch Windows Explorer on votre autre domain controller parce que you (DC01$) are aussi an administrator of that DC as well!
Domain controllers do pas have a local SAM in le même way that regular Windows machines do. (Well they do mais it is seulement used in restore mode.) They tous share le AD Builtin groups, et depuis a Windows system needs to be an administrator of itself in order to function, juste like tout SYSTEM account on tout autre Windows machine, that gives us le interesting side-effect that tous domain controllers end up being administrators of one another.
Edit: Cleaning up for posterity.
Let's do an experiment.
Grab psexec depuis Sysinternals. Transfer it to to votre domain controller.
Run `psexec -s -i cmd.exe` on votre domain controller.
Now in votre nouveau command prompt, type `whoami` et `whoami /groups`. Vous allez see that you are now le SYSTEM account on votre domain controller (aka DC01$) et that you do indeed belong to le Builtin\Administrators group.
Those builtin groups are shared among domain controllers. So voici something neat:
Type `start \\DC02\c$` depuis votre command prompt. It should launch Windows Explorer on votre autre domain controller parce que you (DC01$) are aussi an administrator of that DC as well!
Domain controllers do pas have a local SAM in le même way that regular Windows machines do. (Well they do mais it is seulement used in restore mode.) They tous share le AD Builtin groups, et depuis a Windows system needs to be an administrator of itself in order to function, juste like tout SYSTEM account on tout autre Windows machine, that gives us le interesting side-effect that tous domain controllers end up being administrators of one another.
Edit: Cleaning up for posterity.