Is it true that the administrators of a domain "A" can reset a user's password in another domain "B" within the same Forest "out-of-the-box" ?

I believe that it is not possible for a Domain Administrator to manage another domain in the Forest just like that. Unless he uses some non-standard, malicious, utilities and hacks.

Can anyone confirm this ?

migrated from superuser.com Jun 8 '13 at 18:35

This question came from our site for computer enthusiasts and power users.

  • Are there trusts between the forests? – Hennes Jun 6 '13 at 17:41
  • It is not supposed to work that way "out of the box" – Jason H Jun 6 '13 at 17:56

No, Domain Admins do not have the rights to administrate other Domains within the forrest.

This not "out-of-the-box" behavior, at least not for the "Domain Administrators" group.

If you have a root domain of ad.mycompany.com, and a child domain child.ad.mycompany.com the domain admins from either domain should not be able to administer the other domain. However, the Enterprise administrators group members will be able to administrate the child domain.

However, setting up this behavior wouldn't necessarily be considered malicious if you have low role separation (E.g. Enterprise admins would be the same people as Domain Admins). Also, it wouldn't be necessary to use "not-standard utilities and hacks" as all you would need to do to allow this, is add the Domain Admin group of the parent domain to the Enterprise Admin group.

The domain admins group members in the child domain would still not have rights to administer the parent domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy