I have a sticky situation. We have a computer here at work running Windows XP. Before I came on, the company did not have an IT person, and someone setup a profile on that computer with important Mail Room functionality using the Domain Admin account.

I would like to change this and not give low level employees in the mail room access to the domain admin account for the entire network but the problem I face is that the applications on that profile cannot be replicated. We have tried to duplicate them in another profile and various settings never work correctly, some of the software would need to be reinstalled and its old and the company doesn't have the installers anymore (the software developers have since moved on with newer versions which don't work with our systems. sigh.)

Is there any way for me to preserve this profile and its settings but make it stop being the Administrator profile? I dont even care if it is local admin on the box, just that it is no longer using the same password as the domain admin account.


| improve this question | | | | |
  • Create a new user in AD, AppAdmin1, add that account as a local admin on XP machine. Do not make this a domain admin.
  • Create a 2nd user in AD, AppAdmin2, add that account as a local admin on XP machine. Do not make this a domain admin.
  • Logon to XP machine w/ AppAdmin1 AD acct. This creates the local user profile.
  • Logout.
  • Logon to XP machine w/ AppAdmin2 AD acct.
  • Logout and Reboot. (This clears any open files in any user profiles.)
  • Logon to XP machine w/ AppAdmin2 AD acct.
  • Use ProfileWizard to copy Domain Admin account profile on XP machine to AppAdmin1 profile. This can also be done w/ MoveUser but ProfWiz works better.
  • Reboot, logon as AppAdmin1.
  • Test applications.
  • Once confirmed working under AppAdmin1, change password on Domain Admin account.
  • Create an image of XP machine so it can be run as a VM if existing hardware fails. HyperV, Xen, VMWare can all do this.
  • AppAdmin2 account can be deleted.
| improve this answer | | | | |
  • Hmmm, this sounds promising. And if it don't work the domain admin profile is still there in the mean time. I will have to try this out. Thanks. – Peter Lange Jul 19 '13 at 6:18

Open up Active Directory Users and Computers and find the domain admin user account that you are using on your XP machine. You should be able to change that user account to be a none domain admin account, this is assuming that none of the programs installed actually need domain admin in order to run correctly.

If this was your only domain admin account you should create additional accounts so you can continue to administer your domain.

| improve this answer | | | | |
  • Vote++. There's a chance, with a legacy application that the account needs administrative rights on the PC itself. To grant this, run the following from a command prompt on the PC: net localgroup administrators <username> /add – Simon Catlin Jul 17 '13 at 20:43
  • Unfortunately, for business reasons (not security or IT reasons) I am limited by what I can do. Yes, this is the only Domain Admin account, and I cannot remove this account or demote it to a lesser authority, which is why I am trying to convert the profile for the Domain Admin on this particular computer to another profile. – Peter Lange Jul 17 '13 at 23:47

The other suggestions are terrific and probably easier than mine. But if you want to fix the issues with the apps, odds are the local permissions just need to be fixed once the links and files are dragged over from the existing domain admin profile. I've found over the years that lazy programmers (usually the ones you work with) won't bother to do the work to make the app not require local admin privs. Something like systernals filemon and/or procmon can give you some insight into what the machine/app is doing and why the apps cannot load/start/run. Typically it's missing/restricted registry/file/folder settings that can be changed locally for your non admin user to allow the applications to run. If its a database driven app then its likely it might be using an ODBC link which might be missing and need to be added/moved from user profile to user profile. though the cheat is often to make the regular user account from AD the local admin and most of the time it resolves the issue. Though that isn't really best practice.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.