Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Whenever I run the Group Policy Result wizard and select a Domain Controller as the target computer, the summary shows BUILTIN\Administrators in the list of "Security Group Membership when Group Policy was applied" under Computer Configuration, as illustrated below:

Group Policy Results summary (Domain, user and computer name left out)

Since Domain Controllers are not a member of Administrators (at least not from what I can see in ADUC), my question is simply, why?

Are Domain Controllers actually members of the Administrators group, or is GPResults wrong (and why)?

share|improve this question
add comment

1 Answer

up vote 11 down vote accepted

Yes, you are seeing that correctly.

Let's do an experiment.

Grab psexec from Sysinternals. Transfer it to to your domain controller.

Run psexec -s -i cmd.exe on your domain controller.

Now in your new command prompt, type whoami and whoami /groups. You will see that you are now the SYSTEM account on your domain controller (aka DC01$) and that you do indeed belong to the Builtin\Administrators group.

Those builtin groups are shared among domain controllers. So here's something neat:

Type start \\DC02\c$ from your command prompt. It should launch Windows Explorer on your other domain controller because you (DC01$) are also an administrator of that DC as well!

Domain controllers do not have a local SAM in the same way that regular Windows machines do. (Well they do but it is only used in restore mode.) They all share the AD Builtin groups, and since a Windows system needs to be an administrator of itself in order to function, just like any SYSTEM account on any other Windows machine, that gives us the interesting side-effect that all domain controllers end up being administrators of one another.

Edit: Cleaning up for posterity.

share|improve this answer
    
Just broke out psexec, and sure enough. That actully makes sense :-) Great answer, thanks –  Mathias R. Jessen Mar 12 '13 at 21:34
    
Forgot to clarify - DCs do not have a local SAM. (well they do but it's only used in restore mode.) All DCs share the same SAM, which are those Builtin groups you see in ADUC. –  Ryan Ries Mar 12 '13 at 21:38
    
Yeah, I realize that (that's kinda why i makes sense) :) –  Mathias R. Jessen Mar 12 '13 at 21:39
2  
I didn't know SYSTEM was (implicitly) a member of Administrators... always learning something new :-) –  Massimo Mar 13 '13 at 14:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.