Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The retard who was on the built-in Administrator login somehow (and this is what I'm guessing being as he is not here and I was not present when this occurred - Supposedly it was an "ACCIDENT") Denied the built-in Administrator account and every other account except for his personal one access to our domain - ie "" not just active directory or anything.

I've been trying for literally 2 hours to find some sort of way to take control of the domain through the built-in Admin account with no success; I can't even open Active Directory. I'm not aloud to open DSA.MSC and there's no way for me to take ownership.

Any ideas?

share|improve this question
Do you have a backup of AD? – mrdenny Sep 30 '09 at 4:23
How does one remove all rights assigned to the domain administrator account from a non-AD-controller PC? I'm guessing AD doesn't have some sort of protection built in for having at least one administrative user? – Bart Silverstrim Sep 30 '09 at 11:58

These instructions should help you reset the local administrator, then the domain administrator. You will of course need physical console access to a Domain Controller.

share|improve this answer
I think he has the password, the problem is the built in admin account has had its permissions removed. – Sam Sep 30 '09 at 8:29
He could use the same technique to reset the privileged users password. – Izzy Sep 30 '09 at 13:36

The only way I'd know of is to restore from backup, but that introduces another problem also if you're following the best practices of multiple controllers. AD controllers don't like having one system "rolled back" as it can massively fubar the AD structure.

The second thing...heck...I'd probably have to call an MSCE consultant to fix that issue if you don't have any users with delegated administrative privileges or belonging to and administrative group. They usually have access to Microsoft's support numbers to get through the maze and cut through some of the tape to find the answer if they didn't already know, and if your directory and server structure is valuable for your business...i.e., reconstruction from scratch will take too much time...the cost will be worth it.

I'd love to hear the solution here if/when you find one.

share|improve this answer
Authoritative restores are surprisingly not too painful. The major problem is going to be lost changes. Edit: just realized this was an old question... – Doug Luxem Apr 1 '10 at 18:18
MCSEs don't get free support calls. Certified Partners (at least at Gold level) get a few free calls. But, a support call is only $125, last I knew. Often very worth it, and probably in this case. – mfinni Apr 1 '10 at 20:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.