Re: Enterprise Admins versus Domain Admins versus Schema Admins

Hello Werner,

Enterprise admins can administer all domains in the forest

Domain admins only the domain where they are admin

Schema admins are able to change the schema itself.

Also see:

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!!


Can someone give me a comparison of the teaks that can be performed by
Enterprise Admins, Domain Admins and Schema Admins?

Thanks for your answer,


Relevant Pages

  • Re: Security permissions bug or inheritant permissions??
    ... We had four domain admins for the 8 domains in our forest. ... four guys who were Enterprise Admins. ... management and security folks don't fool themselves with a perception of false ... that doesn't mean that everyone should be domain> "gods" - they should heirarchal structure that enforces layered security> levels - even among domain admins. ...
  • RE: software to control domain administrators
    ... Trustworthy Admins already do this with the explicit knowledge that they ... reverse that auditing, which the auditing mechanism should reflect ... Honestly, if you are looking for something to audit domain admins, then ... Si ha recibido este mensaje por error, ...
  • Use restrictive groups to prevent the change
    ... When a new Domain Controller is created the Default groups (Domain admins, ... Enterprise Admins, Schema admins etc) under the OU users are also created. ... mark on all permissions except for Full controll. ...
  • Re: Administrator
    ... Well as far as the SQL DBA point I brought up, part of the reason for that is ... that there is no global SQL Admins domain group anyway but that wasn't done ... because of Sharepoint especially since SQL Server existed before Sharepoint ... > me a choice which I can choose to include domain admins as ...
  • Re: Enable non-admin users to access member servers or client PC
    ... the client machines they probably will require to be local admins (Not ... In order to modify server folder permissions the group needs to be ... groups like Domain Admins, Administrators, etc. ...