Windows Server 2016 creates several group automatically These are called default local groups and they
include well-known groups such as administrators backup operators and remote desktop users.
Windows Server 2016 creates additional groups automatically in a domain both in the built in container
and the user's container including domain admins enterprise segments and schema admins.
Let's examine default groups that provide administrative privileges.
A subset of default groups has significant permissions and user rights relating to the management of
ADT yes because of their rights they are protected groups protected groups are described later in this
course.
But now let's have a summary of the capabilities of these groups.
Enterprise admins.
This group was created in the user container of the forest through domain.
This group is a member of the administrators group in every domain in the forest which gives it a complete
access to the configuration of all domain controllers.
It also owns the configuration partition of the directory and has full control of the domain name and
context in all four domains.
The next group is schema Edmonds users container of the forest through domain.
This group owns and has full control of the Active Directory schema.
Administrators exists in built in container of each domain.
Members of this group have complete control over all domain controllers and data in the domain name
and context.
They can change the membership of all other administrative groups in the domain and the administrators
group in the forest through domain can change the membership of enterprise segments schema Edmonds and
domain admins the administrators group in the forest through domain is the most powerful service administration
group in the forest.
The next group is domain Edmonds.
It exists and users container of which domain.
This group is added to the administrators group of its domain is therefore inherits the capabilities
of the administrators group.
It also by default added to the local administrators group of which domain member computer.
Thus given domain Edmonds ownership of all domain computers server operators.
It's built in container of each domain.
Members of this group can perform maintenance tasks on domain controllers.
They have the rights to assign in locally start and stop services perform backup and restore operations
for map disks create or delete shares and shut down domain controllers by default.
This group has no members.
Next up is account operators.
This group exists in built in container in each domain.
Members of this group can create modify and delete accounts for users groups and computers located in
any o viewing the domain except the Domain Controller.
So you aren't in the user or computers container account Operators Group members can not modify accounts
that are members of administrator or or domain Edmonds groups nor can they modify those groups account
Operators Group members also can sign in locally to domain controllers by default.
This group has no members.
Next stop backup operators.
It exists and built in container of which domain.
Members of this group can perform backup and restore operations on domain controllers and can sign in
locally and shut down domain controllers by default.
This group has no members and two more left brain to operate or sound sword.
Publishers print operators exist and built in container of each domain.
Members of this group can maintain print queues on domain controllers.
They can also sign in local and shut down domain controllers and by default this group has no members
cert publishers.
Existing and users container of aged domain and members of this group can publish certificates to the
directory by default.
This group has no members.
So to wrap up there are the following default groups enterprise segments schema admins administrators
domain elements server operators account operators backup operators print operators and cert publishers.
You need to careful and manage the default groups that provide administrative privileges because they
typically have broader privileges than are necessary for most delegated environments and because they
often apply protection to their members.
The account Operators Group is a good example of this.
If you examine the capabilities of the counter operators group you can see that members of this group
have very broad rights.
They can even sign in locally to the main controller in very small networks.
You might assign such rights to one or two individuals who are typically domain administrators anyway.
However in large enterprises the rights and permissions granted to account operators are usually far
too broad.
Additionally the counter Operators Group is like the other administrative groups a protected group.
The operating system defines protected groups which can not be unprotected members of a protected group
become protected by association.
And no loner inherit permissions ACL else from there or you but instead receive a copy of an ACL from
the protected group.
This protected group ACL offers considerable protection to the members.
For example if you add Jeff Fort to the account Operators Group his account becomes protected.
The Help Desk which has rights to resent all other user passwords of the employees or you can not resent
Jeff for its path for protected groups include account operators administrators backup operators and
some more such as sort publishers.
Domain Edmonds enterprise Edmonds redone the domain controller as a replicator of server operators.
You should avoid dead end users to the groups that do not have members by default like account operators
backup operators Sora or operators and print operators.
Instead create custom groups to which you assign permissions sound to user rights that achieve your
business and administrative requirements.
For example Scott Mitchell should be able to perform backup operations on a domain controller but should
not be able to perform restore operations that could lead to database rollback or corruption.
In addition Scott should not be able to shut down a domain controller.
So you do not put Scott in the backup operation operators group.
Instead create a local group and assign it only the backup files and directories user right and then
create a global group and add score to the member.
Then add the global group to the local group.