local admin account management on a Windows AD domain

Question

In a Windows AD domain how do you manage local admin accounts ? What I found out:

Every computer has an Administrator account (SID S-1-5-domain-500, display name Administrator). The Administrator account is the first account that is created during the Windows installation.

In Windows 10 and Windows Server 20016, Windows setup disables the built-in Administrator account and creates another local account that is a member of the Administrators group. Members of the Administrators groups can run apps with elevated permissions without using the Run as Administrator option.

In comparison, on the Windows client operating system, a user with a local user account that has Administrator rights is considered the system administrator of the client computer. The first local user account that is created during installation is placed in the local Administrators group.

In this case, Group Policy can be used to enable secure settings that can control the use of the local Administrators group automatically on every server or client computer.

Passwords should be unique per individual account. While this is generally true for individual user accounts, many enterprises have identical passwords for common local accounts, such as the default Administrator account. This also occurs when the same passwords are used for local accounts during operating system deployments.

My questions are:

1. Is it necessary / common to have a local admin account on Windows clients in a AD domain infrastructure ?
2. If 1 is yes, is that local user (member of the Administrator group) deployed to all clients basically with the same SID ?
3. If 2 is yes, is the password the same across all clients?
4. If the above does not / or somehow does make sense, how do you typically deal with local users on clients on a Windows Active Directory domain ?

Thanks and take care guys !

Answer 1

1. There is no way to delete the built-in Administrator account, even if the computer is joined to a domain. It does not have to be enabled, but in an enterprise environment it typically is, because it is the easiest way to recover if the machine loses its connection to the domain for any reason.

2. Each client computer's built-in Administrator account has a different SID, though the suffix is always 500. (They might be the same if you have used cloning without properly preparing the image.) The built-in Administrator account is a member of the Administrators local group, though, and that always has the same SID (S-1-5-32-544).

3. There is nothing preventing you from setting the same local administrator password on all your clients, but this is not recommended because it means that if one computer is compromised all the computers are compromised.

4. The recommended approach is to use Microsoft LAPS, which generates a random password for the local administrator account on each computer and saves it in the Active Directory so the system administrator can look it up if necessary. The download link includes an operations guide to get you started.