I have a question about the windows explorer "active directory search" feature.

A active directory user (member of the domain users group) found out, that when he uses the active directory search, he can edit the domain admins group and add himself as a member.

Does anyone know where I can restrict this?

Thank you

Kind regards

  • There's a difference between adding himself to the group and committing the change. Have you verified he is successful in adding himself to the group? If so, you have a very big permission/delegation problem that needs to be sorted out immediately. Please let us know. – twconnell Oct 29 '18 at 20:24
  • Hello m-admin, were you able to identify the root cause for this issue? – twconnell Nov 2 '18 at 20:10

Examine the group members of "Domain Admins" or "Enterprise Admins" to see if any group he is a member of, is also a member of those groups.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.