In a Windows AD domain how do you manage local admin accounts ? What I found out:

Every computer has an Administrator account (SID S-1-5-domain-500, display name Administrator). The Administrator account is the first account that is created during the Windows installation.

In Windows 10 and Windows Server 20016, Windows setup disables the built-in Administrator account and creates another local account that is a member of the Administrators group. Members of the Administrators groups can run apps with elevated permissions without using the Run as Administrator option.

In comparison, on the Windows client operating system, a user with a local user account that has Administrator rights is considered the system administrator of the client computer. The first local user account that is created during installation is placed in the local Administrators group.

In this case, Group Policy can be used to enable secure settings that can control the use of the local Administrators group automatically on every server or client computer.

Passwords should be unique per individual account. While this is generally true for individual user accounts, many enterprises have identical passwords for common local accounts, such as the default Administrator account. This also occurs when the same passwords are used for local accounts during operating system deployments.

My questions are:

  1. Is it necessary / common to have a local admin account on Windows clients in a AD domain infrastructure ?
  2. If 1 is yes, is that local user (member of the Administrator group) deployed to all clients basically with the same SID ?
  3. If 2 is yes, is the password the same across all clients?
  4. If the above does not / or somehow does make sense, how do you typically deal with local users on clients on a Windows Active Directory domain ?

Thanks and take care guys !

  • Apply the pass the hash mitigations recommended by Microsoft, sppecifically "Restrict and protect local accounts with administrative privileges ".
    – twconnell
    Commented Aug 11, 2019 at 18:34

1 Answer 1

  1. There is no way to delete the built-in Administrator account, even if the computer is joined to a domain. It does not have to be enabled, but in an enterprise environment it typically is, because it is the easiest way to recover if the machine loses its connection to the domain for any reason.

  2. Each client computer's built-in Administrator account has a different SID, though the suffix is always 500. (They might be the same if you have used cloning without properly preparing the image.) The built-in Administrator account is a member of the Administrators local group, though, and that always has the same SID (S-1-5-32-544).

  3. There is nothing preventing you from setting the same local administrator password on all your clients, but this is not recommended because it means that if one computer is compromised all the computers are compromised.

  4. The recommended approach is to use Microsoft LAPS, which generates a random password for the local administrator account on each computer and saves it in the Active Directory so the system administrator can look it up if necessary. The download link includes an operations guide to get you started.

  • Thank you. How does the local admin account (or whatever the account is) make its way to the AD and how can you differentiate the password for each local admin if you have say 1000 workstations ?
    – cyzczy
    Commented Aug 11, 2019 at 10:30
  • 1
    The details are all provided in the download link. There's a technical document as well as the operations guide. In brief, the script that runs on each client to randomize the password writes the new password into the Active Directory. The password is stored in the client's computer object, so all you need to know to look up the right password for any particular client is the computer name. Commented Aug 11, 2019 at 18:09
  • Thank you! I appreciate all your help :)!
    – cyzczy
    Commented Aug 11, 2019 at 20:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .