Domain Admin rights question

mcook76

Hello,

Can anyone tell me how or what I can use to determine the effective rights/permissions the domain admin group has for a domain? I know how to do it per object but I need it for the whole domain. Basically I need to get the default rights and match them up to what I have now to see what has changed.

Thanks in advance to anyone that has the time!

snadam

I normally do it this way:

1. open up ADUC on your DC
2. go to View--->advanced features
3. locate the Domain Admins Group, and open up its properties.
4. Click on the security tab, then click "Advanced"
5. from here you should be able to go to the effective permissions tab and select the 'domain admins' and view its effective permissions.


might be a shorter way, but I can confirm that way works.