1

We have a new Windows 2008 R2 server and we have noticed that the Domain Users group is added to the Local Users group of the server. This server will be used for hosting our webapps. It seems to be a security breach to have this group in the server.

Is there a reason why the Domain Users group is in the Local Users group? Should i remove it?

Improve this question
1
  • 2
    It's there because the Domain Users group is automatically added to the local Users group when a computer is joined to the domain. Likewise, the Domain Admins group is automatically added to the local Administrators group when a computer is joined to the domain.
    – joeqwerty
    Feb 23, 2012 at 21:38

2 Answers 2

Reset to default
9

I wouldn't remove the default nesting of "DOMAIN\Domain Users" from the local "Users" group on member server computers unless you're absolutely sure that you've fully tested the change. For your application, where you're hosting a web based application, you may be just fine. If that application authenticates users and impersonates their domain accounts, though, you may be putting yourself into a nightmare world of troubleshooting. Only you can know this, though.

You're moving away from a default configuration by doing this and my experience is that Microsoft often writes documentation based on the default behavior of their products (and many support resources perform troubleshooting based on an assumption of defaults, as well).

I don't see the harm, personally, in having "DOMAIN\Domain Users" being a member of "Users". I do not see it as a "security breach". Microsoft has taken great care in recent versions of Windows to be sure that the "Users" group is unprivileged. This membership doesn't grant the members things like Remote Desktop capability, ability access "Administrative" file shares, the ability to remotely access the registry, etc.

The onus is on you to test a modification like this and make sure that the environment acts properly in the face of your change. I think your time is better spent making sure you have good password policies, a good IDS/IPS system, well audited firewall rules, good patch application and verification practices, and vulnerability testing of your web applications. This group nesting would not be high on my list of security priorities.

Improve this answer
2
  • Do you have any updated advice in 2021? Thank you.
    – Yolo Perdiem
    Jan 22, 2021 at 17:30
  • 1
    @YoloPerdiem - Not particularly. It's still just default behavior of the product. If you've got a reason to move away from default behavior go for it. Just be aware that lots of software, MSFT and otherwise, make assumptions about default behavior.
    – Evan Anderson
    Jan 24, 2021 at 15:21
8

By default when you join a PC to domain it puts the domain users group in the local users group. You can use GPO to remove this... or, y'know, remove it from the group. There's no real reason if you don't want Domain Users to be able to access this machine to have it set up this way.

Improve this answer
4
  • 2
    +1 - If you don't need it, you don't need it.
    – MDMarra
    Feb 23, 2012 at 21:47
  • What kind of scenarios we will need the Domain Users to be Local Users of the server? A user can have access to a shared folder inside the server but i don't see when a normal user should have access to the server as a Local User.
    – Alexandre Jobin
    Feb 23, 2012 at 22:55
  • I think reading this will give you a better, well rounded answer: technet.microsoft.com/en-us/library/cc785098(v=ws.10).aspx It's relatively short, but gives you good information on the purpose of local groups & their basic rights & interactions with domain users.
    – Ethabelle
    Feb 24, 2012 at 16:29
  • To add a snippet -- domain users added to local users allow users to login to member servers as users. So you would only remove domain users from local groups if you didn't want them to be able to login. Really, I wouldn't remove anyone from Local Users and just restrict people via GPO. It makes it more manageable.
    – Ethabelle
    Feb 24, 2012 at 17:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .