Builtin Administrator Account Question

[seamus151]

I have just recently setup a DC with AD. I am the domain admin and I added four people to the "built-in administrator" account within AD under the domain OU. We put one client on the domain and I had one of the four admins test his privileges. He had no more privileges then a domain user. On the client I opened the "Local Users and Groups" and under administrators group the only account listed was local Administrator and XXdomainXX\Domain Admins. So I created a new custom admin group and made it a member of the "Built-in Administrators" group within AD. The I added the newly created AD custom admin group on the client under the "Administrators" group locally. After doing that, the local admins could administrator the computer.

I have two questions:

1. Shouldn't adding users to the built-in admin account give them admin rights locally on the PC when they authenticate on the pc within the domain?

2. If the above is incorrect, then do I have to manually enter the newly created admin group on each PC that is put on the domain?

I know that I can just include the group on a ghost image etc but I would much rather just be able to add my admins to the built-in admin group within AD and be done with it. What am I missing here?

Thanks for your help!

[Abdulmajid]

As soon as you join a user or computer to the Domain Admin group he is automatically added under local Administrator group. So if you had added them as you said in built-in admin group you had simply added them to the local admin group. Now here if you wan to limit the admin access to those users you will need to create your own group. You have to create a new group with all restrictions and then check back.

[CoYoTeA]

When you work on new installation the only member here lies goes under admin group. Later on when you connect the computer to the domain the you will need to manually work on the administration settings. It is a nice option to work on separate group. Because there you can simply make restrictions as per your need and there is less hassle worrying for full admin rights.

[seamus151]

Thank you very much for all the replies. That makes things much clearer now. And yes I did mean the Builtin Local Admin "group" not account, Sorry for the confusion. It was 14 hours into the job and my brain got a bit fuzzy at that point, LOL.

And thankyou for the KB article, that will help bunches.

Again, thanks for the help, this is a great site and community. I am glad I found it!