Help with troubleshooting Microsoft System Account removing users from Domain Admins Group

2Pac IT
2Pac IT used Ask the Experts™
on
I have an issue where a task/job run by the NT AUTHORITY\SYSTEM removes users from the Domain Admins. I am unable to find out if this is a task, GPO, or what is causing one  our domain controllers to execute this. I then have to go and add all of our domains admins back in the group about 1 or 2 times a day. Is there a powershell command, utility, or any recommendation that will display what time a task or GPO runs to help troubleshoot this process? I need help figuring out what is causing the system account 'NT Authority\System' to remove the users from the domain admins.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
ChrisLead Infrastructure Architect

Commented:
If you have auditing on for AD then you will be able to pin point the time and the source of the change

saving me having to type it out this page gives you details on the event auditng that needs to be configured and the event ID's you need to look for

https://www.lepide.com/how-to/track-and-audit-active-directory-group-membership-changes.html

you can cross check that with the Group Policy log which is one of the granular logs to see if there is a time stamp that correlates and also what GPO it was that was doing a backgroun refresh.
Or the system log that should confirm a scheudled task running
RobertSystem Admin

Commented:
This could be due to protected group.
In the past I had a group that was a member of a protected group and that caused windows to remove the members.

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory

Author

Commented:
Thanks and I am looking at the logs and I have read about protected group and restricted groups. Still no luck...
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Top Expert 2012

Commented:
please post output of
gpresult /h c:\gpreport.html

Open in new window

Author

Commented:
Life1430 is there something specific I can look for and I appreciate the help but I cant post the gp policy due to company policy
Top Expert 2012

Commented:
Nothing specific as such..was expecting any clue if we could find from it
Commented:
The solution was that the group was being modified by the default domain policy GPO - I changed the users in the restricted groups and it works now. Thanks,

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial