<div>
Um, no. <br />
<br />
Never put a service account in Domain admins, to be honest if they need admin rights on a single machine, create a new group in AD, drop this account into that group then the group into the local admins on the machine they need full admin rights on and you should be good to go.<br />
<br />
Realistically, they should give you better information than &quot;Admin rights&quot;
</div>


<div>
I agree with the above, and there does not appear to be a ready made group for this (on Server 2012) so make a new group as suggested above.
</div>


<div>
I don't think there is a ready-made group for this on any Domain Functional Level to be honest.
</div>


<div>
You can do it if you know consequences and your password is very, very. VERY strong
</div>


<div>
Even then, it goes against microsoft best practice.
</div>


<div>
Thank you all, sorry for my lack of knowledge in AD. Can this account can be local admin for a domain controller if it is not in the domain admin?
</div>


<div>
You can make it a domain account and assign the specific authorities you want for the account
</div>


<div>
You may create a problem here if you are unfamiliar. <br />
<br />
You need to make sure the persons who will have these permissions are skilled, trained people. Cowboy administrators can wreck a system before you turn around. <br />
<br />
You may wish to engage a knowledgeable local consultant to set this up and show you how to maintain it.
</div>


<div>
I need an AD account to be a local admin to all servers, but not to be in the domain admin group.<br />
Where can I put this account?
</div>


<div>
Make a new AD Group as we suggested
</div>


<div>
Sara, it would be best if you wrote a few sentences more about what that account will be used for so that you can get proper advice.<br />
So far, we have heard &quot;I have to use this account to run winrm on Domain controller too&quot;, but this is not enough. What will winrm be used for on that DC? What will that account need to fulfill on the other machines?
</div>


<div>
You can create global administrator groups and add this service account to it as a member. With this, it will have administrator's rights on all devices (workstations, servers or both) without domain rights.<br />
<a href="https://www.experts-exchange.com/articles/29596/Securing-Active-Directory-Administrators-Groups.html" rel="ugc">https://www.experts-exchange.com/articles/29596/Securing-Active-Directory-Administrators-Groups.html</a><br />
<br />
Never ever give DA to a service account, even with a secure password. This would enable the account to do a whole bunch of bad things including extracting password hashes<br />
<a href="https://www.experts-exchange.com/articles/29569/How-to-extract-hashes-from-IFM-backup.html" rel="ugc">https://www.experts-exchange.com/articles/29569/How-to-extract-hashes-from-IFM-backup.html</a>
</div>


<div>
Best practices for delegating control in Active Directory:<br />
<a href="https://www.computerweekly.com/news/1280096060/Best-practices-for-delegating-control-in-Active-Directory" rel="ugc">https://www.computerweekly.com/news/1280096060/Best-practices-for-delegating-control-in-Active-Directory</a><br />
<br />
The security of Service Accounts in Active Directory is important and there are some simple things you can do to ensure it: <a href="https://www.lepide.com/blog/nine-tips-for-preventing-misuse-of-service-accounts-in-active-directory/" rel="ugc">https://www.lepide.com/blog/nine-tips-for-preventing-misuse-of-service-accounts-in-active-directory/</a>
</div>


sara2000

<div>
And if you need some custom delegation tasks see delwiz.inf in this article<br />
<a href="https://www.experts-exchange.com/articles/29366/Delegation-the-proper-way.html" rel="ugc">https://www.experts-exchange.com/articles/29366/Delegation-the-proper-way.html</a>
</div>


<div>
Sara, do you realize there are 6 comments after your last comment that you did not give feedback on?
</div>


<div>
The user account which I created called netappsrv.<br />
This user account has to have local administrator prevdledge on all servers including the domain controllers. But. It should not be in the domain admin group.<br />
Can this be achieved?
</div>


<div>
You would have to make the local member a member of the Domain before it can be a member of the admin group
</div>


<div>
You cannot have a local admin account on a domain controller.PERIOD
</div>


<div>
If I can not make a user account to be a local admin/server admin &nbsp;to domain ctrl without that account to be part of the Domain admin, then all the above comments are not going to help me .
</div>


<div>
Why can you not make a local admin member of a Domain? That should help you
</div>


<div>
<a href="https://www.experts-exchange.com/questions/29100999/AD-account-with-admin-privilege.html?anchorAnswerId=42573248#a42573248" rel="ugc">https://www.experts-exchange.com/questions/29100999/AD-account-with-admin-privilege.html?anchorAnswerId=42573248#a42573248</a> needs to be answered. I would finally like to know what your goal is.
</div>


<div>
<blockquote>
This user account has to have local administrator prevdledge on all servers
</blockquote>
Can this be achieved? [/code]<br />
This is what article in <a href="#a42573358" rel="ugc">#a42573358</a>&nbsp;demonstrates.
</div>


<div>
<div class="content wysiwyg-content">
Experts &nbsp;out there. I have to create a service account in AD to be with &nbsp;administrator privilege . What is the best group I can assign this user account?<br />
Should that be in domain admin?<br />
I have to use this account to run winrm on Domain controller too.
</div>
</div>


Experts  out there. I have to create a service account in AD to be with  administrator privilege . What is the best group I can assign this user account?
Should that be in domain admin?
I have to use this account to run winrm on Domain controller too.

AD account with admin privilege

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.