Having read in :
Members of this group have full control of the domain. By default, this group is a member of the Administrators group on all domain controllers, all domain workstations, and all domain member servers at the time they are joined to the domain. By default, the Administrator account is a member of this group. Because the group has full control in the domain, add users with caution."
Members of this group have full control of all domain controllers in the domain. By default, the Domain Admins and Enterprise Admins groups are members of the Administrators group. The Administrator account is also a default member. Because this group has full control in the domain, add users with caution."
and that both Administrators and Domain Admins have exactly the same description in their "Default user rights":
- "Access this computer from the network; Adjust memory quotas for a process; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Enable computer and user accounts to be trusted for delegation; Force a shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Allow log on locally; Manage auditing and security log; Modify firmware environment values; Profile single process; Profile system performance; Remove computer from docking station; Restore files and directories; Shut down the system; Take ownership of files or other objects."
I could not understand:
What are the differences between them?
When to use which in their default incarnation?
How to specialize their engagement?
If the Domain Admins are member of Administrators, doesn't it make them always equal?
"Default Local Groups" tells:
Members of this group have full control of the server and can assign user rights and access control permissions to users as necessary. The Administrator account is also a default member. When this server is joined to a domain, the Domain Admins group is automatically added to this group..."
This question is subquestion and in context of its parent question (as could be seen, without/before this Update2, in Linked section):
- the context of local user of AD-joined machine? Is it of domain machine account or of local machine account?
Default local groups