Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're having a strange problem that we can't fathom out. We have inherited a 2003 FFL/DFL domain that has a mix of 2008 R2 and 2003 DC's. The Workstation Admins group was in Builtin\Administrators, not great I know. We removed said group from the elevated permissions only to find it had returned the next day.

Checking the permissions on the group Builtin\Aministrators only Domain Admins can affect it, as it should be. We used the repadmin to track down when the change happened:

repadmin /showobjmeta DC01 "CN=Administrators,CN=Builtin,DC=Domain,DC=co,DC=uk"

This showed us where and when the change occurred:

PRESENT       member 2012-11-27 10:32:23             Site1\Site1-DC01 2773346 3067148  13

    CN=Workstation Admin,OU=Management Services,OU=HO,OU=Offices,DC=Domain,DC=co,DC=uk

On looking at the security logs on the Site1-DC01 we found:

Event Type: Success Audit
Event Source:   Security
Event Category: Account Management 
Event ID:   636
Date:       27/11/2012
Time:       10:32:23
User:       NT AUTHORITY\SYSTEM
Computer:   STD-DC01
Description:
Security Enabled Local Group Member Added:
    Member Name:    -
    Member ID:  CENTRAL\Workstation Admin
    Target Account Name:    Administrators
    Target Domain:  Builtin
    Target Account ID:  BUILTIN\Administrators
    Caller User Name:   STD-DC01$
    Caller Domain:  CENTRAL
    Caller Logon ID:    (0x0,0x3E7)
    Privileges: -

So, we assumed Group Policy was to blame. On going through all GPO's there is use of User Rights Assignment, Restricted Group Access or Local Users and Groups Assignment. We have also gone through all login scripts and nothing is set there either.

On checking the ADDS logs we can see that replication is working as it should.

It's also worth mentioning that Site1-DC01 holds no FSMO roles nor is it a GC.

We are stumped as to how it gets re-added. Can anyone point out what we're missing?

share|improve this question
    
following the answer below remove the unwanted users/groups from the local admins group, then do a gpupdate /force, What happens? if nothing then reboot the workstation then check things. –  tony roth Nov 28 '12 at 15:21
    
It is the domain builtin\administrators group that the workstation admins group gets added to. I'm pretty convinced it's not group policy as gpupdate /force doesn't add it, plus we've been through every GPO and there is no use on restricted groups, user rights assignment or local user assignment –  malco Nov 29 '12 at 8:19

3 Answers 3

up vote 0 down vote accepted

Sure sounds like a GPO to me...specifically the Restricted Group Access.

Run a "gpresult /Z > gpresult.log"

Then open the log file and look through it.

The only other thing would be to check and see if it gets applied at the same time each day/night. If so, look for a scheduled task somewhere or 3rd party management software that kicks off and changes the permissions.

share|improve this answer
    
It is the domain builtin\administrators group that the workstation admins group gets added to. I'm pretty convinced it's not group policy as gpupdate /force doesn't add it. It does however seem to happen around the same time (give or take 50 secs or so) each day. –  malco Nov 29 '12 at 8:20

Ok, have found the answer. A little embarrassing.

The server had a LANDesk agent on it and there was a LANdesk task that added the workstation admin group to the local admin of all machines on that site and therefore as this is a DC the domain builtin\administrators.

Thank you all for you help though!!

share|improve this answer
    
So pretty much what I said..."or 3rd party management software that kicks off and changes the permissions". –  TheCleaner Nov 29 '12 at 14:31
    
Yep, good call. Have awarded you the answer. –  malco Nov 29 '12 at 17:13

Could be a GPO... The default refresh interval for GPO's is 90 minutes. But if the ADD event is happening longer than 90 minutes after the removal then that's probably not it. If the times of these events is truly random, this may be another possibility.
If an admin or domain admin wanted to cover their tracks, they might try something like this...
Are there any users with interactive logons to STD-DC01 when the event is logged? Look for Logon Type 2 in event 528 for 2003 dc's (or 4624 on 2008 dc's). Someone with a local logon at a DC could invoke "psexec -i -s cmd" to start a process as the system account and then do a 'net localgroup administrators "workstation admin" /add' to make the change under the credentials of the system account. Psexec process would show as a 592 event on 2003 security log. That's what I did to test and I got this event on a 2008 DC. I don't have any 2003 DC's left to see if it produces the exact same event you posted.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          11/28/2012 1:20:37 PM
Event ID:      4732
Task Category: Security Group Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      theDC.acme.com
Description:
A member was added to a security-enabled local group.

Subject:
    Security ID:        SYSTEM
    Account Name:       theDC$
    Account Domain:     acme
    Logon ID:       0x3e7

Member:
    Security ID:        acme\Malco
    Account Name:       -

Group:
    Security ID:        BUILTIN\Administrators
    Group Name:     Administrators
    Group Domain:       Builtin
share|improve this answer
    
don't think "Someone with a local logon at a DC could invoke "psexec -i -s cmd" to start a process as the system account and then do a 'net localgroup administrators "workstation admin" /add'" will cover anybodies tracks since you should know who started the psexec process.. –  tony roth Nov 28 '12 at 20:47
    
As long as you know enough to go look for something like that –  Craig620 Nov 28 '12 at 22:26
    
As my reply above - I'm pretty convinced it's not group policy as gpupdate /force doesn't add it. Plus we've been through all GPO's and can't find any use of restricted groups etc. It does however seem to happen around the same time (give or take 50 secs or so) each day. –  malco Nov 29 '12 at 8:27
    
Scheduled task on that DC configured to run with System credentials? –  Craig620 Nov 29 '12 at 14:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.