Re: Domain users being added to Administrators

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

does this occur only at night or after every reboot ?

Is it the domain admins group or the local administrators group ?

If it's domain admins, review the group membership, and change all
password of member's account

If it's local admin, it may be already a GPO, or scheduled tasks

Cordialement,
Mathieu CHATEAU
french blog: http://www.lotp.fr
english blog: http://lordoftheping.blogspot.com


thajuggla4478 a écrit :
Hello all,

I have ran into a problem where our doamin users group is being added to
our administrators group nightly. I have tried several different things, but
to no avail. I am beginning to suspect that we have a hacker running loose
on our network here. Is there a way that I can lock this out short of using
the GPO?

Thank you,
Brett
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkjX3C4ACgkQR16rF5v5prD+zwCeOHBJgLE9q5uzvW9OKgGqZYJw
P8MAn2+tmiXp9u20f0bZHsTyDkXf6BiJ
=+13k
-----END PGP SIGNATURE-----
.

Relevant Pages

  • Re: Win 2003 Local Admin Problem
    ... You should have defined a built-in Administrators group as a restricted ... I added the local administrators group on my PC. ... Windows Server - Directory Services ... >>>> You can use Restricted Groups feature of the GP to add Domain Admins ...
    (microsoft.public.windows.group_policy)
  • Re: Local Admin access through Active Directory
    ... You can add the user to the local administrators group on the computers that ... administrators group. ... without adding them to the Domain Admins group? ...
    (microsoft.public.security)
  • Re: Win 2003 Local Admin Problem
    ... You can use Restricted Groups feature of the GP to add Domain Admins into ... Windows Server - Directory Services ... > Domain Admins group from the local administrators group on the server. ...
    (microsoft.public.windows.group_policy)
  • RE: ADMT2, cannot migrate computers, access denied
    ... I would like to confirm that if you add the domain admins and ... administrators group into the local administrators group of the original ... On the Windows NT 4.0 PDC, open Administrators group and add the domain ...
    (microsoft.public.windows.server.migration)
  • Re: how to determine if a w2k machine is part of a domain
    ... I guess you could ues IsMember9.vbs to check if the group "Domain Admins" is ... a member of the local Administrators group. ...
    (microsoft.public.scripting.wsh)