Domain Admin Locked out!

From: snazzy (snazzy@nospam)
Date: 04/16/03 

From: "snazzy" <snazzy@nospam>
Date: Tue, 15 Apr 2003 19:23:39 -0700

Here is a good one for ya....I am one of the Network
administrators at a college. Well, not too long ago the
powers that be forced us to give local admin rights to a
select few. Well, only one of them has locked out the
domain admin. I tried to go into manage computer in AD
and couldn't do anything. All it would say is access
denied. When I tried to access the admin $ it said
access denied. I logged in with the users domain account
and it would not let me reset the permissions on the
admin share of move the domain admin account back into
the administrators group. I am stumped and don't know
what to do. Is there anyway I can give the domain admin
back it's rights? Any help would be greatly appreciated!

Relevant Pages

  • RE: How to prevent some specific Domain Admin Accounts from creating U
    ... kamleshqwalani is incorrect - if you add a user to the Built-In Administrators group on a domain controller, that user becomes an administrator on all domain controllers in your domain, and by extension a Domain Admin. ... (kamleshqwalani is correct about local Administrator membership on workstations and member servers, ... So making a user a Domain Admin will automatically profer certain rights to domain-joined workstations and servers that BUILTIN\Administrators does not...but at the end of the day a member of BUILTIN\Administrators on a DC still has the effective rights of a Domain Admin, and so a determined user could figure out how to grant themselves whatever rights they don't have by default on workstations/member servers. ...
    (microsoft.public.windows.server.active_directory)
  • RE: Windows 2000 to Windows 2003 Upgrade!
    ... Admins group was removed from Local Administrators group. ... Windows 2000 to Windows 2003 Upgrade! ... my VBScript logon script will not run for this reason(Seems WMI ... if I am logged on as a domain admin I should be able to access ...
    (microsoft.public.windows.server.migration)
  • Re: True difference between Domain Admin grp and Administrators Group
    ... is a member of the domain "administrator" group by default. ... The domain admin group not only has local administrator ... group is automatically added to the local "administrators" group. ... Members of this group have full control of the domain. ...
    (microsoft.public.windows.server.general)
  • Re: Server Security
    ... In my opinion you want accountability for administrators and each administrator ... "The" administrator account should not be used and given a very long ... make sure that if there is sensitive information on that server, ... > name with domain admin rights on each. ...
    (microsoft.public.win2000.security)
  • Re: Admin accounts for Run As purposes only
    ... the addition of new high-privilege accounts to run when a domain admin logs ... don't have enough servers to achieve a separation. ... At the end of the day, you have to trust your administrators, but it's easy ... > I know we can delegate alot of tasks now such as user account ...
    (microsoft.public.windows.server.active_directory)