Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I recently stumbled over a workstation account being member of the Domain Admins group. I assume that this is not recommended, right?

Nevertheless, I am curious what the actual effects of this constellation are: does everyone logged on to this machine gain the Domain Admin privilege? Or is it limited to the local SYSTEM, SERVICE, etc. accounts? In other words: how big is the security flaw?

share|improve this question

1 Answer

up vote 2 down vote accepted

Services running with the machine account will gain Domain Admin privileges. Users logged into that machine will not inherit such privs. Sometimes this is done if some badly written service that can't run as a user for some reason needs to have access to the entire domain. Also, lazy admins.

As a security flaw it isn't earth-shaking, but it should be resolved. There should be no reason (short of crappy code) for this to be done.

share|improve this answer
+1 for lazy admins and crappy code. =) – Chris S♦ Jan 26 '11 at 18:43
Lazy admins +1 ... – Christoph Jan 26 '11 at 18:52
1  
I'm sure the side-effects can be AWESOME. – mfinni Jan 26 '11 at 18:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.