Wait; EVERYONE's an Admin now?

January 3, 2008 5:15 PM

All users on this Terminal Server seem to be Administrators. How do I downgrade them?

I could spend a a whole lot of unbillable time researching this, but I'll consult the hive mind instead. I am lazy.

Helping someone with a terminal server (Windows Server 2003 R2) in their environment, which is in a configuration that's new to me.

Every account I log in to the TS with, Power User, Admin level, whatever, is coming up with the "Configure Your Server Wizard"; which would indicate that every single user account is an Administrator on this machine. WTF??

It could be a local setting on that server, it could be somehting in the AD for the domain, or something I don't know. Unfortunately, I don't have the time to hunt around for what it might be.


Any suggestions on where to start?

posted by bartleby to computers & internet (5 comments total)

start->run "compmgmt.msc"

Expand the Local Users and Groups portion of the tree, check out membership in the Administrators group.
posted by bfranklin at 5:22 PM on January 3, 2008 [1 favorite]

bfranklin for the win! Thankyou!
posted by bartleby at 5:27 PM on January 3, 2008

Sorry to be chatty, but I'm curious, what was the problem exactly? Were all domain users in the local admin group?
posted by tracert at 6:07 PM on January 3, 2008

Given this behaviour, I'd expect to see the Domain Users group as a member of the machine's local Administrators group. It's an easy slip to make when intending to add Domain Administrators to the local Administrators group.
posted by flabdablet at 6:35 PM on January 3, 2008

Domain Admins are automatically added to the local admin group whenever you join any MS OS to the domain (regardless of workstation or server). Domain Users are added to the local Users group so someone would have either added the staff user accounts to local administrators or Domain Users to local admins.

Either way, it sounds like the company may be in dire need of a knowledgeable Windows admin. No offense bartleby, but this is server administration 101. Whoever you're contracting to do this work needs to be re-trained or terminated.
posted by purephase at 5:15 AM on January 4, 2008