I am changing some permissions on a small work network that I've been playing in. Domain admin and administrator permissions were so tied up that they essentially were the same account.

After getting everything clean I am finally able to have separate permissions on the domain controller. However when I log into a domain admin account and try to run local security policy or group policy management it tells me its blocked by group policy. Add the account the admins and it works again.

I have been unable to find any restricted applications anywhere. The DC's do have their own modified GPO's however I have not found anything to show as the culprit. I have assigned all the same user rights found locally on GPO as administrators as I have domain admins.

Any help is appreciated!

  • Your Domain Admin account should be a member of the "local" Administrators group (which is actually the Built-in Administrators group) on the DC. – I say Reinstate Monica Jun 4 '15 at 1:41

Verify that Domain admin in Domain Admins Groups. Verify that on local machine Domain Admins Administrators Groups. Check applied Group policy object to the Domain Admins. Disable any GPO to Domain admins, reboot machine and try now. Looks like you limited domain admins right and now they not admins anymore.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.