So in AWS I created a Microsoft AD and managed to join a computer to the domain after changing the DHCP optionset. I then rebooted the machine and logged in as the admin account that was created with the domain, but soon realized that the admin account have very strict privileges. I can create new users and add computers to the AD, but that's about it... I can't add users to the domain admin group or even to the remote desktop users group.

Anyone know if there is any way to access the real administrator account when creating a windows active directory in AWS?


Noticed that AWS create delegated groups for you so after i added my users to the "AWS delegated administrators" group everything was fine.

As to why they lock you out of the real domain admin account and groups is beyond me though... sigh

| improve this answer | |
  • restarted too. after this above change. still no luck! – khanna Mar 7 at 11:00

Unfortunately, the answer to the question is "No." You do not have access to the "real" (i.e. -500) Administrator account in the hosted AWS Microsoft AD solution.

Thankfully, this limitation is clearly laid out by Amazon when researching the offering. I have not yet implemented it; we are just reviewing all of the various providers and options, and one of the first things in the FAQ for the service is a clear confirmation.

Amazon has put a lot of time in to preparing / automating this offering, and it requires a great deal of delegation of privileges and permissions so that Amazon's customer can have sufficient access to configure nearly all options of Active Directory while at the same time not allowing customer access to the AD management.

It follows that they would use these same methods to ensure best practices were being followed, specifically, that "Domain Admins" or privileged accounts used for managing AD should not be administrators on member computers.

Regardless, it makes sense - how could they properly guaranty up-time or support the offering if they granted the user the ability to hose the directory at any time?

In order to deliver a managed-service experience, AWS Microsoft AD must disallow operations by customers that would interfere with managing the service. Therefore, AWS does not provide Windows PowerShell access to directory instances, and it restricts access to directory objects, roles, and groups that require elevated privileges. AWS Microsoft AD does not allow direct host access to domain controllers via Telnet, Secure Shell (SSH), or Windows Remote Desktop Connection. When you create an AWS Microsoft AD directory, you are assigned an organizational unit (OU) and an administrative account with delegated administrative rights for the OU. You can create user accounts, groups, and policies within the OU by using standard Remote Server Administration Tools such as Active Directory Users and Groups.

Source: AWS Microsoft AD FAQ

| improve this answer | |
  • Let's say you need to configure an ADFS server on the domain created by the AWS-managed AD. How would you get Domain Admin credentials to set that up? (The AWS-provided admin does not have sufficient rights to do that) – demonicdaron Feb 7 '19 at 10:24
  • 1
    Presumably delegated access is appropriately configured. If you read the FAQ that is linked you'll see that items like Schema extensions are possible by submitting the LDIF to the service for processing. The FAQ indicates that ADFS is compatible with AWS Managed AD, so it is logically follows that they have either delegated access to configure that, or a service front end that allows you to set it up. – Semicolon Feb 7 '19 at 16:17
  • I was able to setup ADFS with an AWS managed AD using this answer: stackoverflow.com/q/54481560/4220401 – demonicdaron Feb 7 '19 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.