Having read in the Microsoft Docs article Default groups the description of these two groups:
Members of this group have full control of the domain. By default, this group is a member of the Administrators group on all domain controllers, all domain workstations, and all domain member servers at the time they are joined to the domain. By default, the Administrator account is a member of this group. Because the group has full control in the domain, add users with caution."
Members of this group have full control of all domain controllers in the domain. By default, the Domain Admins and Enterprise Admins groups are members of the Administrators group. The Administrator account is also a default member. Because this group has full control in the domain, add users with caution."
and that the same article states both groups have exact same description of their Default user rights:
Access this computer from the network; Adjust memory quotas for a process; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Enable computer and user accounts to be trusted for delegation; Force a shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Allow log on locally; Manage auditing and security log; Modify firmware environment values; Profile single process; Profile system performance; Remove computer from docking station; Restore files and directories; Shut down the system; Take ownership of files or other objects.
Further, the Microsoft Docs article Default local groups includes this description of the Administrators group:
Members of this group have full control of the server and can assign user rights and access control permissions to users as necessary. The Administrator account is also a default member. When this server is joined to a domain, the Domain Admins group is automatically added to this group..."
Given the above, I do not understand:
- What are the differences between them?
- When to use which in their default incarnation?
- How to specialize their engagement?
- If the Domain Admins are members of Administrators, doesn't it make them always equal?
This question is sub-question of and asked in context of the question Is the context of local user of AD-joined machine a domain machine account or of local machine account?