I found this question about access to domain controller, which I think is very low quality (VLQ) and therefore should be deleted, since the OP answered it self with "I made a mistake". So I thought there was no useful information for anyone - and felt like I wasted my time, when reading and trying to be helpful.

I read about VLQ and auto-deletion of closed questions, but it's too old to be flagged as VLQ and since OP answered it self, it haven't been auto-deleted as abandoned or dead.

Is there anything I can do, except to flag it with in need of moderator intervention? Or is there someone with higher reputation that agree and have privileges to "do something"?

up vote 2 down vote accepted

I appreciate the constructive feedback here. I'm happy to make whatever edits the community finds most useful (or have the question deleted). Let me describe more precisely the situation, what I misunderstood, and how I resolved it to the best of my current understanding.

This is a Windows Server 2012 R2 Standard server acting as a domain controller (the only domain controller) for a small domain. I took over management of this domain. I was using an account named Administrator with local login name "acmeadmin"* to login to the server. I believed that this was the builtin administrator account, the one in ACME\Users with description "Built-in account for administering the computer/domain". I mistakenly thought the "User logon name" on the account tab of this account had been changed to "acmeadmin" and that this was the account I had been using to administer the server. The logon name for this account was actually "Administrator" but the account was disabled. In reality, there was another account in ACME\MyBusiness\Users\SBSUsers (this server had been upgraded from SBS) also named "Administrator" but with user logon name "acmeadmin". This was the account I was using to administer the server. Both accounts belonged to ACME/Users/Domain Admins and originally both accounts also belonged to ACME/Builtn/Administrators

I discovered a group policy (using "Restrict Groups") that was granting membership in "Builtin/Administrators" group to all users. This group policy was probably intended to make all users local administrators on their workstations--but because of the scope of the group policy, it was also making all users members of the "Builtin/Administrators" group on the server as well. Alarmed, I set out to correct this problem. But instead of changing the scope of the policy so that it affected workstations and not the server, I just removed "Builtin/Administrators" from the restrict groups group policy. As result the account I had been using to administer the server lost it's membership in "Builtin/Administrators" on the server.

As a consequence of this, it also lost the Allow Local Logon right on the server--as this was granted to members of Builtin/Administrators.

I could no longer logon to the server locally with the acmeadmin account (as only administrators are allowed to logon to the server). I was still able to logon to workstations with the acmelogin account as non administrators had the right to logon to workstations.

The default administrator account (ACME/Users) can not lose membership in the Builtin/Administrators group (You get a "cannot perform this action on built in accounts"). I was confused because I thought this was the account I was using when really it was not.

Once I realized my mistake, I was able to boot the server and enable to the builtin Administrator account ACME/Users (I can't remember if I used DSRM or a Linux boot disk). I may have had to reset the password on the built in administrator account too--I can't recall.

Once the builtin administrator account (ACME/Users) was re-enabled, I was able to use it to access the server again and to cleanup my group policy and account problems. I hope this clarifies the situation. Please let me know how we'd like to proceed or if I should add this explanation to the self answer.

NOTE: ACME was not the real domain name

  • 3
    Wow, that's a total dumpster fire, indeed. I would reiterate that Windows Domain controllers don't have local accounts, so you may have thought you were logging in with a local account, but you weren't. Like servers, Windows domains have built-in users and groups, and I think you're just confusing the built-in local accounts with the built-in domain accounts. Also, your question doesn't mention SBS, which would have been an important detail, because SBS is a dumpster fire in its own right. – HopelessN00b Feb 22 at 6:39
  • 2
    Yea, definitely was a bad situation all around. Agreed there no local accounts on DCs. Did I refer to local accounts somewhere? I didn't think I had. I did incorrectly refer to the "Allow logon locally" docs.microsoft.com/en-us/windows/security/threat-protection/… policy setting as "Allow local logon" (it was close!) . I should have mentioned the origins in SBS (though it had been upgraded to Standard). Thanks for the feedback. – scotru Feb 22 at 6:57
  • 1
    I'll delete the question. – scotru Feb 22 at 7:00
  • 1
    The default administrator account is no longer a member of BuildIn\Administrators group is what I was going off of. That group is almost always mentioned in reference to the built-in local group in Windows land, IME. Though you're right, you didn't explicitly say anything about local groups, and I read that into your question and answer (which I realize is a lot more ambiguous than it first appeared, now that I've re-read them.). – HopelessN00b Feb 22 at 7:06
  • 1
    Thanks for the input @scotru! Maybe I should have contacted or mentioned you more directly from the beginning, but I'm glad you bumped in and provided that explanation. It can really be a mess, if display and usernames are different. I accepted your answer instead, since that was of course the best ;-) – PatrikN Feb 22 at 13:25
  • 1
    I think this long explanation would be very useful in the answer to the actual question. Any mistake made by one person can be made by another person, who may benefit from learning from the first one. – Jenny D Feb 23 at 8:21

I strongly disagree that there is no useful information for anyone. ‘I noticed these symptoms but it turned out they where the result of me doing X wrong’ is useful information for anyone doing the same thing wrong (and not noticing it).

Also, in a way, if you read any question with an accepted answer in order to help, you have always a good chance to “waste your time”, because the answer usually solves the problem.

  • 1
    Thanks for the input, I learned a lesson and changed my mind. I have improved both the question and answer to be more usable. – PatrikN Feb 22 at 3:47
  • 2
    Well, it’s VLQ because the OP doesn’t understand how domain controllers work. They don’t really have local accounts, and the default Adminstrator account is only accessible when booting into DSRM (directory services restore mode), not normal operation. So, actually, that self answered QA is a raging dumpster fire, and probably should be deleted, though not for the reasons given by the OP here. – HopelessN00b Feb 22 at 4:54

As Sven notes, your reason for thinking that’s a VLQ in need of deletion are wrong, but you are right that it is VLQ and should probably be deleted.

Domain controllers don’t really have local accounts, and the built-in administrator account is reserved for directory services restore mode (DSRM), which is why he couldn’t find it. His self answer is total crap, and I can definitively state that he didn’t do what he claimed (or wasn’t doing it on a domain controller, at least).

So yes, I agree that this question and answer is delete-worthy crap.

Since it seems like you won’t be able to get the mods to delete it, the other option is to get it voted down to the level that delete votes are available to the higher rep users with that privilege (-3, I think, and maybe a question with an answer needs to be closed too), and then get three high-rep users to cast a delete vote.

... which you do by basically doing what you’ve done here, making your case and drawing attention to it in meta. I’ve done my part. If you can attract another couple downvotes to it, I’ll be happy to throw my delete vote at it too.

  • 1
    Ah, thanks for reminding me about DSRM, but I think you missed one thing. As far as I remember, the local admin account used to install AD, is copied or "converted" to a domain user and the "original" is preserved in DSRM, so it becomes two separate accounts (and profiles). There is at least always a "default" Administrator account in the Users folder in the root of the AD, with the description "Built-in account for administering the computer/domain". – PatrikN Feb 22 at 5:38
  • 1
    @PatrikN The last couple domains I stood up, I did so using a local administrator account named "setup" that was not a built-in default, and I'm almost 100% sure that I didn't end up with a "setup" domain account in the new domains. I can't recall off the top of my head if the default, built-in domain\Administrator account is related to the default, built-in local Administrator account from the member server that's promoted to the first domain controller, but that's kind of academic - either way, the two are distinct accounts, with different GIUDs and SIDs. – HopelessN00b Feb 22 at 6:05
  • 1
    Well, maybe it's just the user profile, but never mind now. And thanks for joining and looking at the issue. – PatrikN Feb 22 at 13:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .