Delete Domain admins from local administrators group on member server

Question

Hi,

By default the domain admins group is added by default in local administrators group.
Our security team ask us to remove it from local administrators group.

My question is : There is any impact if we perform this action ?

Answer 1

Hi,

If the Security teams want implement the 3 tiers administration model , it's recommended to remove domain admins group on local administrators on each server and computer in tiers 1 and tiers 2.

To get more details about 3 tiers model you can refer to the following link : use-microsofts-active-directory-tier-administrative-model

Before performing this action , you should check if there is any service account member of domain admins already used to run a scheduled task or service in member server.

Please don't forget to mark helpful reply as answer