Solved

limits of a local admin

Posted on 2014-02-20
3
369 Views
Last Modified: 2014-03-05
can you help me find the technet document that lists the limitations of a local admin vs domain admin
0
Comment
Question by:25112
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 5

Author Comment

by:25112
ID: 39874501
mainly need to validate this
"A Local admin cannot make a domain account an admin, only Domain admins can do that"
with a msdn link.

thanks.
0
 
LVL 19

Assisted Solution

by:helpfinder
helpfinder earned 250 total points
ID: 39874518
local admin is admin for a single computer
domai admin is admin for entire domain (for all computers joined into domain)

here you have an article about domain and local admins:
http://technet.microsoft.com/en-us/library/bb726982.aspx
0
 
LVL 16

Accepted Solution

by:
cantoris earned 250 total points
ID: 39875383
Just to expand on the above,
A local administrator has administrative access to JUST that one local machine.  That admin account is created locally on that machine and lives within its Security Accounts Manager database.  It is recognised only on that machine.  It can only appear to work on other machines if those machines have the exact same username and password created on them.

A domain administrator has administrative access to ALL the machines in the domain.  That account lives within Active Directory and is part of the domain admins group.  The domain admins group is automatically made a member of the local administrators group on all machines joined to the domain.  So a domain admin had administrative rights to all machines.

To go from being a local admin to a full domain admin is a massive jump UP, so a local admin cannot promote an account to domain admin for security reasons.
A local admin CAN add a domain account to the LOCAL administrators group of the SAME machine that the admin account lives on.  That admin is only granting administrative access to something he already has full control over.
0

Featured Post

Office 365 Advanced Training for Admins

Special Offer:  Buy 1 course, get 2nd free!  Buy the 'Managing Office 365 Identities & Requirements' course w/ Accelerated TestPrep, and automatically receive the 'Enabling Office 365 Services' course FREE!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Windows functions GetTickCount and timeGetTime retrieve the number of milliseconds since the system was started. However, the value is stored in a DWORD, which means that it wraps around to zero every 49.7 days. This article shows how to solve t…
This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question