10

Why are users created on the domain controller always part of the domain?

When I want to create a local user on the domain controller, net user <username> <password> /add, I find that the user is automatically included in the Domain Users group.

I want to create a local administrator account on the domain controller, not part of the domain, that is able to log onto the domain controller interactively and carry out administrative tasks.

Is this possible?

1
  • 2
    No. It isn't possible.
    – joeqwerty
    Oct 29, 2018 at 13:34

2 Answers 2

3

Local accounts are stored in a file called the SAM database. This exists on a domain controller - if you boot a domain controller in restore mode then the account you use to do this is just the local administrator account in the SAM database. However when Windows is running normally access to the SAM database is disabled and none of the accounts in it can be used. That means it is impossible to log on with a local account on a domain controller.

However this can be sort of done if you are happy to work from a command line and if you don't require network access. The trick is to log on as the local system account. Windows does not provide any way to do this but I have done it by writing a simple telnet server then running it as a service using the local system account. When you connect to the telnet server you are logged in as the system account not a domain account. The only restrictions are that it's command line only and the system account has no network access. If you're going to use a hack like this be very, very careful about security!

Though all this sounds like a horrible hack it does have legitimate uses. For example at work we use a management tool called N-able that allows remote access to a console on servers, and it does it using basically the technique I describe above. If I open a console on one of our domain controllers and use the whoami command I get:

enter image description here

Footnote

Windows has no built in method for opening a remote command prompt, but as grawity mentions in a comment The SysInternals psexec utility can do this, and the SysInternals utilities are provided and supported by Microsoft so this is at least semi official. Using psexec on one of my servers I get:

D:\temp\psexec>psexec64 \\cheddar -s cmd.exe

PsExec v2.2 - Execute processes remotely
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals - www.sysinternals.com


Microsoft Windows [Version 10.0.17134.345]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
nt authority\system

C:\Windows\system32>exit
cmd.exe exited on cheddar with error code 0.
3
  • Did you reinvent SysInternals psexec -s? Oct 30, 2018 at 7:22
  • 1
    @grawity I first did this on Windows NT 3.1 before the Sysinternals utilities existed :-) However you make a good point. I'd forgotten that psexec could do that. Oct 30, 2018 at 7:24
  • 1
    Point taken. Though hopefully the original "wide open" telnetd isn't in use now? Oct 30, 2018 at 7:48
23

No, this is not possible. Domain controllers don't have their own authentication database. It is replaced by Active Directory when promoted to a Domain Controller.

10
  • 2
    This answers "Is this possible?" from the question body, but does not answer "why" from the title. Any insigths on the "why" part?
    – Mołot
    Oct 29, 2018 at 14:09
  • 8
    Domain controllers don't have their own authentication database. It is replaced by Active Directory when promoted to a Domain Controller is the why. So this does answer the why.
    – joeqwerty
    Oct 29, 2018 at 14:29
  • 4
    @peterh Only Microsoft may know why they designed it that way, but I doubt they know. During my handover, most "why" questions I had to answer with "I did because this was the first thing that came to mind, and it worked, and after that, never change a running system."
    – Alexander
    Oct 29, 2018 at 20:22
  • 5
    Honestly, if the question is "Why did Microsoft design it this way?" is the question, I'd VTC. Any answer we would provide would be pure speculation (unless someone here worked on that project at MS circa 1999-ish?). Oct 29, 2018 at 20:28
  • 2
    I was a MS MVP for Windows server back then and did some stuff with the "NT 5" beta team and went to a few meetings where design decisions were discussed. The argument then was that there wasn't really any such thing as a "local" administrator action on a domain controller as anything had the potential to affect the domain. Want to reboot the DC? Want to add or remove a role? Want to change the DNS settings on the network card? All potentially able to affect the ability of that DC to service it's domain and therefore not really "local admin" actions on a DC.
    – Rob Moir
    Oct 30, 2018 at 10:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .