They both should have very similar rights especially the domain Admin group when member of Administrators. Not in my case. In addition, Administrator account can not login anymore. Test admin have admin rights when member of Domain Admin but not when member of Administrators group. How come? Thanks

  • Are you sure you are looking at the correct administrators group, and not one from a member server or workstation? – Zoredache Sep 7 '18 at 22:38
  • Oh, just realized, there is a group created by the system for those which can not be synchronised with the initial AD server. Domain Admin is a member. So, it is related to the AD migration back in a while. The initial server has now its AD role stopped. However I can not get rid of it just yet as the accountancy software is interacting with. This is a kind of instable situation. Need to find a way to reset admin rights on the new without messing up the old 2008. At least until accountancy guys install a new server... – ezOne Sep 7 '18 at 23:21

Ordinary Windows machines each have their own Administrators local group, but Domain Controllers are special: they share a single Administrators domain local group. Any user in the Administrators domain local group has administrative privilege on all Domain Controllers, but not on other domain members, each of which has their own Administrators group.

When a Windows machine is promoted to Domain Controller, the local Administrators group disappears and is functionally replaced by the domain local group. If the Domain Controller is later demoted, however, the local Administrators group reappears and takes over from the domain local group.

From the sounds of it, you are talking about users that are in the domain local Administrators group and a server that used to be a Domain Controller but has now been demoted. In this scenario, the expected behaviour is for those users to lose administrative privilege on that server.

If you still want them to be administrators, you must add them to the local Administrators group on the server in question, or to Domain Admins, or to any other domain group which is a member of the local Administrators group.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.