I've built a forest for testing consisting of a forest root domain and two child domains. Enterprise admins in the root domain don't seem to have admin privileges on member servers in the child domains.

In Active Directory Domains and Trusts the transitive trusts validate.

DCDiag shows no errors.

Repadmin /showrepl shows no errors and all succesful authentications.

DNS seems to be working fine. Zones are replicated to all AD integrated DNS servers in the forest.

NLTest shows everything seems to be fine:

enter image description here

But when I log in to a child domain member server as a forest root Enterprise Admin (which works fine), I don't get admin permissions:

enter image description here enter image description here

What else can I check?

1 Answer 1


The default permissions are working as designed. Enterprise Admins do not receive any admin permissions on workstations or member servers.

See https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory#enterprise-admins

Enterprise Admins have no default rights on workstations or member servers.

Domain Admins also inherit all rights and permissions granted to the domain's Administrators group and the local Administrators group on all systems joined to the domain.

  • Thanks. It's confusing because it says immediately before that "many of this group's rights are actually inherited by the EA group because it is a member of the Administrators group in each domain in the forest". I think I need to understand more about the differences between the Administrators group and the Domain Admins group.
    – Matt
    Dec 11, 2018 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .