I recently stumbled over a workstation account being member of the Domain Admins group. I assume that this is not recommended, right?
Nevertheless, I am curious what the actual effects of this constellation are: does everyone logged on to this machine gain the Domain Admin privilege? Or is it limited to the local SYSTEM, SERVICE, etc. accounts? In other words: how big is the security flaw?