Remove original domain admin from Domain Admins group

James Jensen 1 Reputation point
2020-12-15T16:14:02.977+00:00

We have an odd issue that certain software across our environment has to be managed by the user account that installed it. This was always installed under the original domain\Administrator account (was renamed something else a long time ago but is still the well-known *-500 SID)
Since we have a few other Domain Admin accounts, can the original *-500 account be "demoted" to a standard account and then given access to only the things it needs?

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,452 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,809 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Fan Fan 15,326 Reputation points Microsoft Vendor
    2020-12-16T02:47:33.977+00:00

    Hi,

    First of all, the built-in domain administrator is not suggested to be used as a service account to run any applications.
    If certain software across your environment has to be managed by the user account that installed it. You can consider to uninstall it and change a account to install and run it.
    The original -500 account can't be "demoted" to a standard account, but here are some ways to security it by Implementing Least-Privilege Administrative Models.
    Include removing it from the administrators group you mentioned above.
    Following links for your reference:
    Implementing Least-Privilege Administrative Models
    Appendix G: Securing Administrators Groups in Active Directory

    Best Regards,

  2. Thameur-BOURBITA 32,831 Reputation points
    2020-12-21T10:29:15.893+00:00

    Hi,

    You can disable the administrators account -500 SID via GPO. You can add this settings on one of GPO applied on Domain controllers OU:

    49839-image.png

    Please Don't forget to mark this reply as answer if it help you to fix your issue

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.