4

I would like to create a group policy to set a specific password for all local administrator users. Now even though you can't manage local users on a domain controller ("This snap-in cannot be used on a domain controller"), even on a DC, the local and domain admins are distinct entities, right? So if I set up my group policy, it won't affect the domain admin passwords, right? But if I link this GP to the whole domain, it will affect the local admin password on the DC, which, if demoted, will matter, right?

The GP I'm planning to use: Computer configuration, Preferences, Control Panel Settings, Local users and groups, local user, update.

Improve this question

1 Answer 1

Reset to default
5

A DC doesn't have a local Administrator account (or any other local user account); if/when you demote it, the demotion process will ask you for a new password for the newly-created local Administrator user.

Be careful, though: depending on the specific way you use to set the password, it could affect the domain Administrator if the GPO gets applied to a DC.

Improve this answer
5
  • I updated the post and named the GP. Are you saying the local accounts are deleted when you promote a machine to a DC? Aren't they only inactivated, made unusable, and can be later reactivated?
    – fejesjoco
    Jul 4, 2011 at 12:08
  • @fejesjoco - They are deleted.
    – Ethos
    Jul 4, 2011 at 12:16
  • 1
    @fejesjoco: when you promote the first DC and create a domain, all local accounts on the server become domain accounts (including Administrator). When you promote an additional DC into an existing domain, all local accounts are deleted (the promotion wizard even warns you about this).
    – Massimo
    Jul 4, 2011 at 12:32
  • Okay, so, now that I mentioned which GP I'm talking about, it shouldn't touch the domain admin, even if applied on the DC, right?
    – fejesjoco
    Jul 4, 2011 at 13:35
  • @fejesjoco: right, that setting simply doesn't apply to domain controllers.
    – Massimo
    Jul 4, 2011 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .