I recently stumbled over a workstation account being member of the Domain Admins group. I assume that this is not recommended, right?

Nevertheless, I am curious what the actual effects of this constellation are: does everyone logged on to this machine gain the Domain Admin privilege? Or is it limited to the local SYSTEM, SERVICE, etc. accounts? In other words: how big is the security flaw?


Services running with the machine account will gain Domain Admin privileges. Users logged into that machine will not inherit such privs. Sometimes this is done if some badly written service that can't run as a user for some reason needs to have access to the entire domain. Also, lazy admins.

As a security flaw it isn't earth-shaking, but it should be resolved. There should be no reason (short of crappy code) for this to be done.

  • 1
    +1 for lazy admins and crappy code. =) – Chris S Jan 26 '11 at 18:43
  • Lazy admins +1 ... – Christoph Jan 26 '11 at 18:52
  • 1
    I'm sure the side-effects can be AWESOME. – mfinni Jan 26 '11 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.