Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to create a group policy to set a specific password for all local administrator users. Now even though you can't manage local users on a domain controller ("This snap-in cannot be used on a domain controller"), even on a DC, the local and domain admins are distinct entities, right? So if I set up my group policy, it won't affect the domain admin passwords, right? But if I link this GP to the whole domain, it will affect the local admin password on the DC, which, if demoted, will matter, right?

The GP I'm planning to use: Computer configuration, Preferences, Control Panel Settings, Local users and groups, local user, update.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

A DC doesn't have a local Administrator account (or any other local user account); if/when you demote it, the demotion process will ask you for a new password for the newly-created local Administrator user.

Be careful, though: depending on the specific way you use to set the password, it could affect the domain Administrator if the GPO gets applied to a DC.

share|improve this answer
    
I updated the post and named the GP. Are you saying the local accounts are deleted when you promote a machine to a DC? Aren't they only inactivated, made unusable, and can be later reactivated? –  fejesjoco Jul 4 '11 at 12:08
    
@fejesjoco - They are deleted. –  Ethos Jul 4 '11 at 12:16
1  
@fejesjoco: when you promote the first DC and create a domain, all local accounts on the server become domain accounts (including Administrator). When you promote an additional DC into an existing domain, all local accounts are deleted (the promotion wizard even warns you about this). –  Massimo Jul 4 '11 at 12:32
    
Okay, so, now that I mentioned which GP I'm talking about, it shouldn't touch the domain admin, even if applied on the DC, right? –  fejesjoco Jul 4 '11 at 13:35
    
@fejesjoco: right, that setting simply doesn't apply to domain controllers. –  Massimo Jul 4 '11 at 14:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.