They both should have very similar rights especially the domain Admin group when member of Administrators. Not in my case. In addition, Administrator account can not login anymore. Test admin have admin rights when member of Domain Admin but not when member of Administrators group. How come? Thanks
Ordinary Windows machines each have their own
Administrators local group, but Domain Controllers are special: they share a single
Administrators domain local group. Any user in the
Administrators domain local group has administrative privilege on all Domain Controllers, but not on other domain members, each of which has their own
When a Windows machine is promoted to Domain Controller, the local
Administrators group disappears and is functionally replaced by the domain local group. If the Domain Controller is later demoted, however, the local
Administrators group reappears and takes over from the domain local group.
From the sounds of it, you are talking about users that are in the domain local
Administrators group and a server that used to be a Domain Controller but has now been demoted. In this scenario, the expected behaviour is for those users to lose administrative privilege on that server.
If you still want them to be administrators, you must add them to the local
Administrators group on the server in question, or to
Domain Admins, or to any other domain group which is a member of the local