Remove original domain admin from Domain Admins group

Question

We have an odd issue that certain software across our environment has to be managed by the user account that installed it. This was always installed under the original domain\Administrator account (was renamed something else a long time ago but is still the well-known *-500 SID)
Since we have a few other Domain Admin accounts, can the original *-500 account be "demoted" to a standard account and then given access to only the things it needs?

Answer 1

Hi,

First of all, the built-in domain administrator is not suggested to be used as a service account to run any applications.
If certain software across your environment has to be managed by the user account that installed it. You can consider to uninstall it and change a account to install and run it.
The original -500 account can't be "demoted" to a standard account, but here are some ways to security it by Implementing Least-Privilege Administrative Models.
Include removing it from the administrators group you mentioned above.
Following links for your reference:
Implementing Least-Privilege Administrative Models
Appendix G: Securing Administrators Groups in Active Directory

Best Regards,

Answer 2

Hi,

You can disable the administrators account -500 SID via GPO. You can add this settings on one of GPO applied on Domain controllers OU:

Please Don't forget to mark this reply as answer if it help you to fix your issue