In a Windows AD domain how do you manage local admin accounts ? What I found out:
Every computer has an Administrator account (SID S-1-5-domain-500, display name Administrator). The Administrator account is the first account that is created during the Windows installation.
In Windows 10 and Windows Server 20016, Windows setup disables the built-in Administrator account and creates another local account that is a member of the Administrators group. Members of the Administrators groups can run apps with elevated permissions without using the Run as Administrator option.
In comparison, on the Windows client operating system, a user with a local user account that has Administrator rights is considered the system administrator of the client computer. The first local user account that is created during installation is placed in the local Administrators group.
In this case, Group Policy can be used to enable secure settings that can control the use of the local Administrators group automatically on every server or client computer.
Passwords should be unique per individual account. While this is generally true for individual user accounts, many enterprises have identical passwords for common local accounts, such as the default Administrator account. This also occurs when the same passwords are used for local accounts during operating system deployments.
My questions are:
- Is it necessary / common to have a local admin account on Windows clients in a AD domain infrastructure ?
- If 1 is yes, is that local user (member of the Administrator group) deployed to all clients basically with the same SID ?
- If 2 is yes, is the password the same across all clients?
- If the above does not / or somehow does make sense, how do you typically deal with local users on clients on a Windows Active Directory domain ?
Thanks and take care guys !