Avatar of 2Pac IT
2Pac IT
 asked on

Help with troubleshooting Microsoft System Account removing users from Domain Admins Group

I have an issue where a task/job run by the NT AUTHORITY\SYSTEM removes users from the Domain Admins. I am unable to find out if this is a task, GPO, or what is causing one  our domain controllers to execute this. I then have to go and add all of our domains admins back in the group about 1 or 2 times a day. Is there a powershell command, utility, or any recommendation that will display what time a task or GPO runs to help troubleshoot this process? I need help figuring out what is causing the system account 'NT Authority\System' to remove the users from the domain admins.
PowershellWindows Server 2012Active Directory

Avatar of undefined
Last Comment
2Pac IT

8/22/2022 - Mon
Chris

If you have auditing on for AD then you will be able to pin point the time and the source of the change

saving me having to type it out this page gives you details on the event auditng that needs to be configured and the event ID's you need to look for

https://www.lepide.com/how-to/track-and-audit-active-directory-group-membership-changes.html

you can cross check that with the Group Policy log which is one of the granular logs to see if there is a time stamp that correlates and also what GPO it was that was doing a backgroun refresh.
Or the system log that should confirm a scheudled task running
Robert

This could be due to protected group.
In the past I had a group that was a member of a protected group and that caused windows to remove the members.

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory
2Pac IT

ASKER
Thanks and I am looking at the logs and I have read about protected group and restricted groups. Still no luck...
Your help has saved me hundreds of hours of internet surfing.
fblack61
Sarang Tinguria

please post output of
gpresult /h c:\gpreport.html

Open in new window

2Pac IT

ASKER
Life1430 is there something specific I can look for and I appreciate the help but I cant post the gp policy due to company policy
Sarang Tinguria

Nothing specific as such..was expecting any clue if we could find from it
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER CERTIFIED SOLUTION
2Pac IT

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question