Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a new Windows 2008 R2 server and we have noticed that the Domain Users group is added to the Local Users group of the server. This server will be used for hosting our webapps. It seems to be a security breach to have this group in the server.

Is there a reason why the Domain Users group is in the Local Users group? Should i remove it?

share|improve this question
It's there because the Domain Users group is automatically added to the local Users group when a computer is joined to the domain. Likewise, the Domain Admins group is automatically added to the local Administrators group when a computer is joined to the domain. – joeqwerty Feb 23 '12 at 21:38

I wouldn't remove the default nesting of "DOMAIN\Domain Users" from the local "Users" group on member server computers unless you're absolutely sure that you've fully tested the change. For your application, where you're hosting a web based application, you may be just fine. If that application authenticates users and impersonates their domain accounts, though, you may be putting yourself into a nightmare world of troubleshooting. Only you can know this, though.

You're moving away from a default configuration by doing this and my experience is that Microsoft often writes documentation based on the default behavior of their products (and many support resources perform troubleshooting based on an assumption of defaults, as well).

I don't see the harm, personally, in having "DOMAIN\Domain Users" being a member of "Users". I do not see it as a "security breach". Microsoft has taken great care in recent versions of Windows to be sure that the "Users" group is unprivileged. This membership doesn't grant the members things like Remote Desktop capability, ability access "Administrative" file shares, the ability to remotely access the registry, etc.

The onus is on you to test a modification like this and make sure that the environment acts properly in the face of your change. I think your time is better spent making sure you have good password policies, a good IDS/IPS system, well audited firewall rules, good patch application and verification practices, and vulnerability testing of your web applications. This group nesting would not be high on my list of security priorities.

share|improve this answer

By default when you join a PC to domain it puts the domain users group in the local users group. You can use GPO to remove this... or, y'know, remove it from the group. There's no real reason if you don't want Domain Users to be able to access this machine to have it set up this way.

share|improve this answer
+1 - If you don't need it, you don't need it. – MDMarra Feb 23 '12 at 21:47
What kind of scenarios we will need the Domain Users to be Local Users of the server? A user can have access to a shared folder inside the server but i don't see when a normal user should have access to the server as a Local User. – Alexandre Jobin Feb 23 '12 at 22:55
I think reading this will give you a better, well rounded answer: It's relatively short, but gives you good information on the purpose of local groups & their basic rights & interactions with domain users. – Ethabelle Feb 24 '12 at 16:29
To add a snippet -- domain users added to local users allow users to login to member servers as users. So you would only remove domain users from local groups if you didn't want them to be able to login. Really, I wouldn't remove anyone from Local Users and just restrict people via GPO. It makes it more manageable. – Ethabelle Feb 24 '12 at 17:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.