Active Directory Schema Adminstrator

In Windows AD there is Schema Administrator. I wonder if Enterprise Admin and Domain Admin have the privileges of Schema Admin by default.
OR
We'll have to add Enterprise and Domain Admin to Schema Admins group, for the specified accounts to have the Schema Admin privileges?

Thank you
jskfanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Radhakrishnan RSenior Technical LeadCommented:
Hi,

Regarding your question about " if Enterprise Admin and Domain Admin have the privileges of Schema Admin by default" - The answer is No. You need assign the schema admin group to the appropriate users in order get access to schema.

There is a good discussion about the privileges from EE, please have a look http://www.experts-exchange.com/Software/Server_Software/Active_Directory/Q_27313423.html

Thanks
0
amac81Commented:
Typically I would recommend that you only add the users who need access to the schema directly, and only for the time that they need the access to complete the work they're doing and then remove them.
0
AmitIT ArchitectCommented:
All these three group: Enterprise and Domain Admin to Schema Admins has different role to play. I normally prefer not to keep anyone in  Enterprise and Schema Admin group. Until you have any specific requirement, where you need account to part of these groups. Like Exchange server upgrade etc.

Schema is like a Blue print for your AD environment. Any changes made to it cannot be revert back again. Especially, if you made any custom changes manually.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

jskfanAuthor Commented:
I just installed a new Domain , with 2 DCs. I checked the membership of Administrator account, and found that it is member of Enterprise /Schema/Domain admins.
That's by default.

What I believe, is when you install a new domain, you will become Enterprise Admin, and Enterprise Admin, can manually add Schema Admin and Domain Admin to Enterprise admin group...
So , I did not do that manually, Microsoft thought it is up to the Enterprise Admin to choose if they need in the Enterprise Admin group or he can remove them.

That's my guessing
0
AmitIT ArchitectCommented:
Administrator ID by default will be part of all these groups. If you need other ID's to have same access you can add them to required group. Domain admin is enough for managing AD.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jskfanAuthor Commented:
Thank you
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.