Active Directory Security Groups
Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2012
This reference topic for the IT professional describes the default Active Directory security groups.
There are two forms of common security principals in Active Directory: user accounts and computer accounts. These accounts represent a physical entity (a person or a computer). User accounts can also be used as dedicated service accounts for some applications. Security groups are used to collect user accounts, computer accounts, and other groups into manageable units.
In the Windows Server operating system, there are several built-in accounts and security groups that are preconfigured with the appropriate rights and permissions to perform specific tasks. For Active Directory, there are two types of administrative responsibilities:
Service administrators Responsible for maintaining and delivering Active Directory Domain Services (AD DS), including managing domain controllers and configuring the AD DS.
Data administrators Responsible for maintaining the data that is stored in AD DS and on domain member servers and workstations.
About Active Directory groups
Groups are used to collect user accounts, computer accounts, and other groups into manageable units. Working with groups instead of with individual users helps simplify network maintenance and administration.
There are two types of groups in Active Directory:
Distribution groups Used to create email distribution lists.
Security groups Used to assign permissions to shared resources.
Distribution groups
Distribution groups can be used only with email applications (such as Exchange Server) to send email to collections of users. Distribution groups are not security enabled, which means that they cannot be listed in discretionary access control lists (DACLs).
Security groups
Security groups can provide an efficient way to assign access to resources on your network. By using security groups, you can:
Assign user rights to security groups in Active Directory.
User rights are assigned to a security group to determine what members of that group can do within the scope of a domain or forest. User rights are automatically assigned to some security groups when Active Directory is installed to help administrators define a person’s administrative role in the domain.
For example, a user who is added to the Backup Operators group in Active Directory has the ability to back up and restore files and directories that are located on each domain controller in the domain. This is possible because, by default, the user rights Backup files and directories and Restore files and directories are automatically assigned to the Backup Operators group. Therefore, members of this group inherit the user rights that are assigned to that group.
You can use Group Policy to assign user rights to security groups to delegate specific tasks. For more information about using Group Policy, see User Rights Assignment.
Assign permissions to security groups for resources.
Permissions are different than user rights. Permissions are assigned to the security group for the shared resource. Permissions determine who can access the resource and the level of access, such as Full Control. Some permissions that are set on domain objects are automatically assigned to allow various levels of access to default security groups, such as the Account Operators group or the Domain Admins group.
Security groups are listed in DACLs that define permissions on resources and objects. When assigning permissions for resources (file shares, printers, and so on), administrators should assign those permissions to a security group rather than to individual users. The permissions are assigned once to the group, instead of several times to each individual user. Each account that is added to a group receives the rights that are assigned to that group in Active Directory, and the user receives the permissions that are defined for that group.
Like distribution groups, security groups can be used as an email entity. Sending an email message to the group sends the message to all the members of the group.
Group scope
Groups are characterized by a scope that identifies the extent to which the group is applied in the domain tree or forest. The scope of the group defines where the group can be granted permissions. The following three group scopes are defined by Active Directory:
Universal
Global
Domain Local
Note
In addition to these three scopes, the default groups in the Builtin container have a group scope of Builtin Local. This group scope and group type cannot be changed.
The following table lists the three group scopes and more information about each scope for a security group.
Group scopes
Scope |
Possible Members |
Scope Conversion |
Can Grant Permissions |
Possible Member of |
|---|---|---|---|---|
Universal |
Accounts from any domain in the same forest Global groups from any domain in the same forest Other Universal groups from any domain in the same forest |
Can be converted to Domain Local scope Can be converted to Global scope if the group does not contain any other Universal groups |
On any domain in the same forest or trusting forests |
Other Universal groups in the same forest Domain Local groups in the same forest or trusting forests Local groups on computers in the same forest or trusting forests |
Global |
Accounts from the same domain Other Global groups from the same domain |
Can be converted to Universal scope if the group is not a member of any other global group |
On any domain in the same forest, or trusting domains or forests |
Universal groups from any domain in the same forest Other Global groups from the same domain Domain Local groups from any domain in the same forest, or from any trusting domain |
Domain Local |
Accounts from any domain or any trusted domain Global groups from any domain or any trusted domain Universal groups from any domain in the same forest Other Domain Local groups from the same domain Accounts, Global groups, and Universal groups from other forests and from external domains |
Can be converted to Universal scope if the group does not contain any other Domain Local groups |
Within the same domain |
Other Domain Local groups from the same domain Local groups on computers in the same domain, excluding built-in groups that have well-known SIDs |
Special identity groups
Special identities are generally referred to as groups. Special identity groups do not have specific memberships that can be modified, but they can represent different users at different times, depending on the circumstances. Some of these groups include Creator Owner, Batch, and Authenticated User.
For information about all the special identity groups, see Special Identities.
Default security groups
Default groups, such as the Domain Admins group, are security groups that are created automatically when you create an Active Directory domain. You can use these predefined groups to help control access to shared resources and to delegate specific domain-wide administrative roles.
Many default groups are automatically assigned a set of user rights that authorize members of the group to perform specific actions in a domain, such as logging on to a local system or backing up files and folders. For example, a member of the Backup Operators group has the right to perform backup operations for all domain controllers in the domain.
When you add a user to a group, the user receives all the user rights that are assigned to the group and all the permissions that are assigned to the group for any shared resources.
Default groups are located in the Builtin container and in the Users container in Active Directory Users and Computers. The Builtin container includes groups that are defined with the Domain Local scope. The Users includes contains groups that are defined with Global scope and groups that are defined with Domain Local scope. You can move groups that are located in these containers to other groups or organizational units (OU) within the domain, but you cannot move them to other domains.
Some of the administrative groups that are listed in this topic and all members of these groups are protected by a background process that periodically checks for and applies a specific security descriptor. This descriptor is a data structure that contains security information associated with a protected object. This process ensures that any successful unauthorized attempt to modify the security descriptor on one of the administrative accounts or groups will be overwritten with the protected settings.
The security descriptor is present on the AdminSDHolder object. This means that if you want to modify the permissions on one of the service administrator groups or on any of its member accounts, you must modify the security descriptor on the AdminSDHolder object so that it will be applied consistently. Be careful when you make these modifications because you are also changing the default settings that will be applied to all of your protected administrative accounts.
Active Directory default security groups by operating system version
The following tables provide descriptions of the default groups that are located in the Builtin and Users containers in each operating system.
Default Security Group |
Windows Server 2012 R2 |
Windows Server 2012 |
Windows Server 2008 R2 |
Windows Server 2008 |
|---|---|---|---|---|
Yes |
Yes |
|||
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
|||
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
|||
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
||||
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
|||
Yes |
Yes |
|||
Yes |
Yes |
|||
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
|||
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Yes |
Yes |
|
Yes |
Yes |
Access Control Assistance Operators
Members of this group can remotely query authorization attributes and permissions for resources on the computer.
The Access Control Assistance Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-579 |
Type |
BuiltIn Local |
Default container |
CN=BuiltIn, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Account Operators
The Account Operators group grants limited account creation privileges to a user. Members of this group can create and modify most types of accounts, including those of users, local groups, and global groups, and members can log in locally to domain controllers.
Members of the Account Operators group cannot manage the Administrator user account, the user accounts of administrators, or the Administrators, Server Operators, Account Operators, Backup Operators, or Print Operators groups. Members of this group cannot modify user rights.
The Account Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
Note
By default, this built-in group has no members, and it can create and manage users and groups in the domain, including its own membership and that of the Server Operators group. This group is considered a service administrator group because it can modify Server Operators, which in turn can modify domain controller settings. As a best practice, leave the membership of this group empty, and do not use it for any delegated administration. This group cannot be renamed, deleted, or moved.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-548 |
Type |
BuiltIn Local |
Default container |
CN=BuiltIn, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
Allow log on locally: SeInteractiveLogonRight |
Administrators
Members of the Administrators group have complete and unrestricted access to the computer, or if the computer is promoted to a domain controller, members have unrestricted access to the domain.
The Administrators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
Note
The Administrators group has built-in capabilities that give its members full control over the system. This group cannot be renamed, deleted, or moved. This built-in group controls access to all the domain controllers in its domain, and it can change the membership of all administrative groups. Membership can be modified by members of the following groups: the default service Administrators, Domain Admins in the domain, or Enterprise Admins. This group has the special privilege to take ownership of any object in the directory or any resource on a domain controller. This account is considered a service administrator group because its members have full access to the domain controllers in the domain.
This security group includes the following changes since Windows Server 2008:
Default user rights changes: Allow log on through Terminal Services existed in Windows Server 2008, and it was replaced by Allow log on through Remote Desktop Services.
Remove computer from docking station was removed in Windows Server 2012 R2.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-544 |
Type |
BuiltIn Local |
Default container |
CN=BuiltIn, DC=<domain>, DC= |
Default members |
Administrator, Domain Admins, Enterprise Admins |
Default member of |
None |
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
Adjust memory quotas for a process: SeIncreaseQuotaPrivilege Access this computer from the network: SeNetworkLogonRight Allow log on locally: SeInteractiveLogonRight Allow log on through Remote Desktop Services: SeRemoteInteractiveLogonRight Back up files and directories: SeBackupPrivilege Bypass traverse checking: SeChangeNotifyPrivilege Change the system time: SeSystemTimePrivilege Change the time zone: SeTimeZonePrivilege Create a pagefile: SeCreatePagefilePrivilege Create global objects: SeCreateGlobalPrivilege Create symbolic links: SeCreateSymbolicLinkPrivilege Debug programs: SeDebugPrivilege Enable computer and user accounts to be trusted for delegation: SeEnableDelegationPrivilege Force shutdown from a remote system: SeRemoteShutdownPrivilege Impersonate a client after authentication: SeImpersonatePrivilege Increase scheduling priority: SeIncreaseBasePriorityPrivilege Load and unload device drivers: SeLoadDriverPrivilege Log on as a batch job: SeBatchLogonRight Manage auditing and security log: SeSecurityPrivilege Modify firmware environment values: SeSystemEnvironmentPrivilege Perform volume maintenance tasks: SeManageVolumePrivilege Profile system performance: SeSystemProfilePrivilege Profile single process: SeProfileSingleProcessPrivilege Remove computer from docking station: SeUndockPrivilege Restore files and directories: SeRestorePrivilege Shut down the system: SeShutdownPrivilege Take ownership of files or other objects: SeTakeOwnershipPrivilege |
Allowed RODC Password Replication Group
The purpose of this security group is to manage a RODC password replication policy. This group has no members by default, and it results in the condition that new Read-only domain controllers do not cache user credentials. The Denied RODC Password Replication Group group contains a variety of high-privilege accounts and security groups. The Denied RODC Password Replication group supersedes the Allowed RODC Password Replication group.
The Allowed RODC Password Replication group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-571 |
Type |
Domain local |
Default container |
CN=Users DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Backup Operators
Members of the Backup Operators group can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can log on to and shut down the computer. This group cannot be renamed, deleted, or moved. By default, this built-in group has no members, and it can perform backup and restore operations on domain controllers. Its membership can be modified by the following groups: default service Administrators, Domain Admins in the domain, or Enterprise Admins. It cannot modify the membership of any administrative groups. While members of this group cannot change server settings or modify the configuration of the directory, they do have the permissions needed to replace files (including operating system files) on domain controllers. Because of this, members of this group are considered service administrators.
The Backup Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-551 |
Type |
Builtin local |
Default container |
CN=BuiltIn, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
Allow log on locally: SeInteractiveLogonRight Back up files and directories: SeBackupPrivilege Log on as a batch job: SeBatchLogonRight Restore files and directories: SeRestorePrivilege Shut down the system: SeShutdownPrivilege |
Certificate Service DCOM Access
Members of this group are allowed to connect to certification authorities in the enterprise.
The Certificate Service DCOM Access group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-<domain>-574 |
Type |
Domain Local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Cert Publishers
Members of the Cert Publishers group are authorized to publish certificates for User objects in Active Directory.
The Cert Publishers group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-<domain>-517 |
Type |
Domain Local |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
|
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
None |
Cloneable Domain Controllers
Members of the Cloneable Domain Controllers group that are domain controllers may be cloned. In Windows Server 2012 R2 and Windows Server 2012, you can deploy domain controllers by copying an existing virtual domain controller. In a virtual environment, you no longer have to repeatedly deploy a server image that is prepared by using sysprep.exe, promote the server to a domain controller, and then complete additional configuration requirements for deploying each domain controller (including adding the virtual domain controller to this security group).
For more information, see Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100).
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-522 |
Type |
Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Cryptographic Operators
Members of this group are authorized to perform cryptographic operations. This security group was added in Windows Vista Service Pack 1 (SP1) to configure Windows Firewall for IPsec in Common Criteria mode.
The Cryptographic Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group was introduced in Windows Vista Service Pack 1, and it has not changed in subsequent versions.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-569 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Denied RODC Password Replication Group
Members of the Denied RODC Password Replication group cannot have their passwords replicated to any Read-only domain controller.
The purpose of this security group is to manage a RODC password replication policy. This group contains a variety of high-privilege accounts and security groups. The Denied RODC Password Replication Group supersedes the Allowed RODC Password Replication Group.
This security group includes the following changes since Windows Server 2008:
- Windows Server 2012 changed the default members to include Cert Publishers.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-572 |
Type |
Domain local |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
Group Policy Creator Owners krbtgt |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
|
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Distributed COM Users
Members of the Distributed COM Users group are allowed to launch, activate, and use Distributed COM objects on the computer. Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. Distributed Component Object Model (DCOM) allows applications to be distributed across locations that make the most sense to you and to the application. This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
The Distributed COM Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-562 |
Type |
Builtin Local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
DnsUpdateProxy
Members of the DnsUpdateProxy group are DNS clients. They are permitted to perform dynamic updates on behalf of other clients (such as DHCP servers). A DNS server can develop stale resource records when a DHCP server is configured to dynamically register host (A) and pointer (PTR) resource records on behalf of DHCP clients by using dynamic update. Adding clients to this security group mitigates this scenario.
However, to protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account and configure DHCP servers to perform DNS dynamic updates by using the credentials of this account (user name, password, and domain). Multiple DHCP servers can use the credentials of one dedicated user account.
For information, see DNS Record Ownership and the DnsUpdateProxy Group.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-1103 |
Type |
Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
DnsAdmins
Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions.
For information about other means to secure the DNS server service, see Securing the DNS Server Service.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-1102 |
Type |
Domain local |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Domain Admins
Members of the Domain Admins security group are authorized to administer the domain. By default, the Domain Admins group is a member of the Administrators group on all computers that have joined a domain, including the domain controllers. The Domain Admins group is the default owner of any object that is created in Active Directory for the domain by any member of the group. If members of the group create other objects, such as files, the default owner is the Administrators group.
The Domain Admins group controls access to all domain controllers in a domain, and it can modify the membership of all administrative accounts in the domain. Membership can be modified by members of the service administrator groups in its domain (Administrators and Domain Admins), and by members of the Enterprise Admins group. This is considered a service administrator account because its members have full access to the domain controllers in a domain.
The Domain Admins group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-<domain>-512 |
Type |
Domain Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
Administrator |
Default member of |
|
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
See Administrators |
Domain Computers
This group can include all computers and servers that have joined the domain, excluding domain controllers. By default, any computer account that is created automatically becomes a member of this group.
The Domain Computers group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-<domain>-515 |
Type |
Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
All computers joined to the domain, excluding domain controllers |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Yes (but not required) |
Safe to delegate management of this group to non-Service admins? |
Yes |
Default User Rights |
None |
Domain Controllers
The Domain Controllers group can include all domain controllers in the domain. New domain controllers are automatically added to this group.
The Domain Controllers group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-<domain>-516 |
Type |
Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
Computer accounts for all domain controllers of the domain |
Default member of |
|
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
No |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
None |
Domain Guests
The Domain Guests group includes the domain’s built-in Guest account. When members of this group sign in as local guests on a domain-joined computer, a domain profile is created on the local computer.
The Domain Guests group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-<domain>-514 |
Type |
Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
Guest |
Default member of |
|
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Can be moved out but it is not recommended |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
See Guests |
Domain Users
The Domain Users group includes all user accounts in a domain. When you create a user account in a domain, it is automatically added to this group.
By default, any user account that is created in the domain automatically becomes a member of this group. This group can be used to represent all users in the domain. For example, if you want all domain users to have access to a printer, you can assign permissions for the printer to this group (or add the Domain Users group to a local group on the print server that has permissions for the printer).
The Domain Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-<domain>-513 |
Type |
Domain Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
Administrator krbtgt |
Default member of |
|
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
See Users |
Enterprise Admins
The Enterprise Admins group exists only in the root domain of an Active Directory forest of domains. It is a Universal group if the domain is in native mode; it is a Global group if the domain is in mixed mode. Members of this group are authorized to make forest-wide changes in Active Directory, such as adding child domains.
By default, the only member of the group is the Administrator account for the forest root domain. This group is automatically added to the Administrators group in every domain in the forest, and it provides complete access for configuring all domain controllers. Members in this group can modify the membership of all administrative groups. Membership can be modified only by the default service administrator groups in the root domain. This is considered a service administrator account.
The Enterprise Admins group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<root domain>-519 |
Type |
Universal (if Domain is in Native-Mode) else Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
Administrator |
Default member of |
|
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
See Administrators |
Enterprise Read-Only Domain Controllers
Members of this group are Read-Only Domain Controllers in the enterprise. Except for account passwords, a Read-only domain controller holds all the Active Directory objects and attributes that a writable domain controller holds. However, changes cannot be made to the database that is stored on the Read-only domain controller. Changes must be made on a writable domain controller and then replicated to the Read-only domain controller.
Read-only domain controllers address some of the issues that are commonly found in branch offices. These locations might not have a domain controller. Or, they might have a writable domain controller, but not the physical security, network bandwidth, or local expertise to support it.
For more information, see AD DS: Read-Only Domain Controllers.
The Enterprise Read-Only Domain Controllers group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-498 |
Type |
Universal |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
|
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Event Log Readers
Members of this group can read event logs from local computers. The group is created when the server is promoted to a domain controller.
The Event Log Readers group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-573 |
Type |
Builtin local |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Group Policy Creators Owners
This group is authorized to create, edit, or delete Group Policy Objects in the domain. By default, the only member of the group is Administrator.
For information about other features you can use with this security group, see Group Policy Planning and Deployment Guide.
The Group Policy Creators Owners group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-<domain>-520 |
Type |
Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
Administrator |
Default member of |
|
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
No |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
Guests
Members of the Guests group have the same access as members of the Users group by default, except that the Guest account has further restrictions. By default, the only member is the Guest account. The Guests group allows occasional or one-time users to sign in with limited privileges to a computer’s built-in Guest account.
When a member of the Guests group signs out, the entire profile is deleted. This includes everything that is stored in the %userprofile% directory, including the user's registry hive information, custom desktop icons, and other user-specific settings. This implies that a guest must use a temporary profile to sign in to the system. This security group interacts with the Group Policy setting Do not logon users with temporary profiles when it is enabled. This setting is located under the following path:
Computer Configuration\Administrative Templates\System\User Profiles
Note
A Guest account is a default member of the Guests security group. People who do not have an actual account in the domain can use the Guest account. A user whose account is disabled (but not deleted) can also use the Guest account. The Guest account does not require a password. You can set rights and permissions for the Guest account as in any user account. By default, the Guest account is a member of the built-in Guests group and the Domain Guests global group, which allows a user to sign in to a domain. The Guest account is disabled by default, and we recommend that it stay disabled.
The Guests group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-546 |
Type |
Builtin Local |
Default container |
CN=BuiltIn, DC=<domain>, DC= |
Default members |
Guest |
Default member of |
Guest |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
None |
Hyper-V Administrators
Members of the Hyper-V Administrators group have complete and unrestricted access to all the features in Hyper-V. Adding members to this group helps reduce the number of members required in the Administrators group, and further separates access.
Note
Prior to Windows Server 2012, access to features in Hyper-V was controlled in part by membership in the Administrators group.
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-578 |
Type |
Builtin local |
Default container |
CN=BuiltIn, DC=<domain>, DC= |
Default members |
None |
Default member of |
No |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
IIS_IUSRS
IIS_IUSRS is a built-in group that is used by Internet Information Services beginning with IIS 7.0. A built-in account and group are guaranteed by the operating system to always have a unique SID. IIS 7.0 replaces the IUSR_MachineName account and the IIS_WPG group with the IIS_IUSRS group to ensure that the actual names that are used by the new account and group will never be localized. For example, regardless of the language of the Windows operating system that you install, the IIS account name will always be IUSR, and the group name will be IIS_IUSRS.
For more information, see Understanding Built-In User and Group Accounts in IIS 7.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-568 |
Type |
BuiltIn Local |
Default container |
CN=BuiltIn, DC=<domain>, DC= |
Default members |
IUSR |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
|
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Incoming Forest Trust Builders
Members of the Incoming Forest Trust Builders group can create incoming, one-way trusts to this forest. Active Directory provides security across multiple domains or forests through domain and forest trust relationships. Before authentication can occur across trusts, Windows must determine whether the domain being requested by a user, computer, or service has a trust relationship with the logon domain of the requesting account.
To make this determination, the Windows security system computes a trust path between the domain controller for the server that receives the request and a domain controller in the domain of the requesting account. A secured channel extends to other Active Directory domains through interdomain trust relationships. This secured channel is used to obtain and verify security information, including security identifiers (SIDs) for users and groups.
Note
This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
For more information, see How Domain and Forest Trusts Work: Domain and Forest Trusts.
The Incoming Forest Trust Builders group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
Note
This group cannot be renamed, deleted, or moved.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-557 |
Type |
BuiltIn local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
None |
Network Configuration Operators
Members of the Network Configuration Operators group can have the following administrative privileges to manage configuration of networking features:
Modify the Transmission Control Protocol/Internet Protocol (TCP/IP) properties for a local area network (LAN) connection, which includes the IP address, the subnet mask, the default gateway, and the name servers.
Rename the LAN connections or remote access connections that are available to all the users.
Enable or disable a LAN connection.
Modify the properties of all of remote access connections of users.
Delete all the remote access connections of users.
Rename all the remote access connections of users.
Issue ipconfig, ipconfig /release, or ipconfig /renew commands.
Enter the PIN unblock key (PUK) for mobile broadband devices that support a SIM card.
Note
This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
The Network Configuration Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
Note
This group cannot be renamed, deleted, or moved.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-556 |
Type |
BuiltIn local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
Yes |
Default User Rights |
None |
Performance Log Users
Members of the Performance Log Users group can manage performance counters, logs, and alerts locally on the server and from remote clients without being a member of the Administrators group. Specifically, members of this security group:
Can use all the features that are available to the Performance Monitor Users group.
Can create and modify Data Collector Sets after the group is assigned the Log on as a batch job user right.
Warning
If you are a member of the Performance Log Users group, you must configure Data Collector Sets that you create to run under your credentials.
Cannot use the Windows Kernel Trace event provider in Data Collector Sets.
For members of the Performance Log Users group to initiate data logging or modify Data Collector Sets, the group must first be assigned the Log on as a batch job user right. To assign this user right, use the Local Security Policy snap-in in Microsoft Management Console.
Note
This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
The Performance Log Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
Note
This account cannot be renamed, deleted, or moved.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-559 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
Yes |
Default User Rights |
Log on as a batch job: SeBatchLogonRight |
Performance Monitor Users
Members of this group can monitor performance counters on domain controllers in the domain, locally and from remote clients, without being a member of the Administrators or Performance Log Users groups. The Windows Performance Monitor is a Microsoft Management Console (MMC) snap-in that provides tools for analyzing system performance. From a single console, you can monitor application and hardware performance, customize what data you want to collect in logs, define thresholds for alerts and automatic actions, generate reports, and view past performance data in a variety of ways.
Specifically, members of this security group:
Can use all the features that are available to the Users group.
Can view real-time performance data in Performance Monitor.
Can change the Performance Monitor display properties while viewing data.
Cannot create or modify Data Collector Sets.
Warning
You cannot configure a Data Collector Set to run as a member of the Performance Monitor Users group.
Note
This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). This group cannot be renamed, deleted, or moved.
The Performance Monitor Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-558 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
Yes |
Default User Rights |
None |
Pre–Windows 2000 Compatible Access
Members of the Pre–Windows 2000 Compatible Access group have Read access for all users and groups in the domain. This group is provided for backward compatibility for computers running Windows NT 4.0 and earlier. By default, the special identity group, Everyone, is a member of this group. Add users to this group only if they are running Windows NT 4.0 or earlier.
Warning
This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
The Pre–Windows 2000 Compatible Access group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-554 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
If you choose the Pre–Windows 2000 Compatible Permissions mode, Everyone and Anonymous are members, and if you choose the Windows 2000-only permissions mode, Authenticated Users are members. |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
Access this computer from the network: SeNetworkLogonRight Bypass traverse checking: SeChangeNotifyPrivilege |
Print Operators
Members of this group can manage, create, share, and delete printers that are connected to domain controllers in the domain. They can also manage Active Directory printer objects in the domain. Members of this group can locally sign in to and shut down domain controllers in the domain.
This group has no default members. Because members of this group can load and unload device drivers on all domain controllers in the domain, add users with caution. This group cannot be renamed, deleted, or moved.
The Print Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008. However, in Windows Server 2008 R2, functionality was added to manage print administration. For more information, see Assigning Delegated Print Administrator and Printer Permission Settings in Windows Server 2008 R2.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-550 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
Allow log on locally: SeInteractiveLogonRight Load and unload device drivers: SeLoadDriverPrivilege Shut down the system: SeShutdownPrivilege |
Protected Users
Members of the Protected Users group are afforded additional protection against the compromise of credentials during authentication processes.
This security group is designed as part of a strategy to effectively protect and manage credentials within the enterprise. Members of this group automatically have non-configurable protection applied to their accounts. Membership in the Protected Users group is meant to be restrictive and proactively secure by default. The only method to modify the protection for an account is to remove the account from the security group.
This domain-related, global group triggers non-configurable protection on devices and host computers running Windows Server 2012 R2 and Windows 8.1, and on domain controllers in domains with a primary domain controller running Windows Server 2012 R2. This greatly reduces the memory footprint of credentials when users sign in to computers on the network from a non-compromised computer.
Depending on the account’s domain functional level, members of the Protected Users group are further protected due to behavior changes in the authentication methods that are supported in Windows.
Members of the Protected Users group cannot authenticate by using the following Security Support Providers (SSPs): NTLM, Digest Authentication, or CredSSP. Passwords are not cached on a device running Windows 8.1, so the device fails to authenticate to a domain when the account is a member of the Protected User group.
The Kerberos protocol will not use the weaker DES or RC4 encryption types in the preauthentication process. This means that the domain must be configured to support at least the AES cipher suite.
The user’s account cannot be delegated with Kerberos constrained or unconstrained delegation. This means that former connections to other systems may fail if the user is a member of the Protected Users group.
The default Kerberos ticket-granting tickets (TGTs) lifetime setting of four hours is configurable by using Authentication Policies and Silos, which can be accessed through the Active Directory Administrative Center. This means that when four hours has passed, the user must authenticate again.
The Protected Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This group was introduced in Windows Server 2012 R2. For more information about how this group works, see Protected Users Security Group.
The following table specifies the properties of the Protected Users group.
Attribute |
Value |
|---|---|
Well-known SID/RID |
S-1-5-21-<domain>-525 |
Type |
Domain Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-service admins? |
No |
Default user rights |
None |
RAS and IAS Servers
Computers that are members of the RAS and IAS Servers group, when properly configured, are allowed to use remote access services. By default, this group has no members. Computers that are running the Routing and Remote Access service are added to the group automatically, such as IAS servers and Network Policy Servers. Members of this group have access to certain properties of User objects, such as Read Account Restrictions, Read Logon Information, and Read Remote Access Information.
The RAS and IAS Servers group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-553 |
Type |
Domain local |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-Service admins? |
Yes |
Default User Rights |
None |
RDS Endpoint Servers
Servers that are members in the RDS Endpoint Servers group can run virtual machines and host sessions where user RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group.
For information about Remote Desktop Services, see Remote Desktop Services Design Guide.
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-553 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
RDS Management Servers
Servers that are members in the RDS Management Servers group can be used to perform routine administrative actions on servers running Remote Desktop Services. This group needs to be populated on all servers in a Remote Desktop Services deployment. The servers running the RDS Central Management service must be included in this group.
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-577 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
RDS Remote Access Servers
Servers in the RDS Remote Access Servers group provide users with access to RemoteApp programs and personal virtual desktops. In Internet facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers that are used in the deployment need to be in this group.
For information about RemoteApp programs, see Overview of RemoteApp
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-575 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Remote Desktop Users
The Remote Desktop Users group on an RD Session Host server is used to grant users and groups permissions to remotely connect to an RD Session Host server. This group cannot be renamed, deleted, or moved. It appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
The Remote Desktop Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-555 |
Type |
Builtin Local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
Yes |
Default User Rights |
None |
Read-Only Domain Controllers
This group is comprised of the Read-only domain controllers in the domain. A Read-only domain controller makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role.
Because administration of a Read-only domain controller can be delegated to a domain user or security group, an Read-only domain controller is well suited for a site that should not have a user who is a member of the Domain Admins group. A Read-only domain controller encompasses the following functionality:
Read-only AD DS database
Unidirectional replication
Credential caching
Administrator role separation
Read-only Domain Name System (DNS)
For information about deploying a Read-only domain controller, see Read-Only Domain Controllers Step-by-Step Guide.
This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-521 |
Type |
|
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
|
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
Remote Management Users
Members of the Remote Management Users group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.
The Remote Management Users group is generally used to allow users to manage servers through the Server Manager console, whereas the WinRMRemoteWMIUsers_ group is allows remotely running Windows PowerShell commands.
For more information, see WS-Management Protocol (Windows) and About WMI (Windows).
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-580 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Replicator
Computers that are members of the Replicator group support file replication in a domain. Windows Server operating systems use the File Replication service (FRS) to replicate system policies and logon scripts stored in the System Volume (SYSVOL). Each domain controller keeps a copy of SYSVOL for network clients to access. FRS can also replicate data for the Distributed File System (DFS), synchronizing the content of each member in a replica set as defined by DFS. FRS can copy and maintain shared files and folders on multiple servers simultaneously. When changes occur, content is synchronized immediately within sites and by a schedule between sites.
Important
In Windows Server 2008 R2, FRS cannot be used for replicating DFS folders or custom (non-SYSVOL) data. A Windows Server 2008 R2 domain controller can still use FRS to replicate the contents of a SYSVOL shared resource in a domain that uses FRS for replicating the SYSVOL shared resource between domain controllers. However, Windows Server 2008 R2 servers cannot use FRS to replicate the contents of any replica set apart from the SYSVOL shared resource. The DFS Replication service is a replacement for FRS, and it can be used to replicate the contents of a SYSVOL shared resource, DFS folders, and other custom (non-SYSVOL) data. You should migrate all non-SYSVOL FRS replica sets to DFS Replication. For more information, see File Replication Service (FRS) Is Deprecated in Windows Server 2008 R2 (Windows).
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-552 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |
Schema Admins
Members of the Schema Admins group can modify the Active Directory schema. This group exists only in the root domain of an Active Directory forest of domains. It is a Universal group if the domain is in native mode; it is a Global group if the domain is in mixed mode.
The group is authorized to make schema changes in Active Directory. By default, the only member of the group is the Administrator account for the forest root domain. This group has full administrative access to the schema.
The membership of this group can be modified by any of the service administrator groups in the root domain. This is considered a service administrator account because its members can modify the schema, which governs the structure and content of the entire directory.
For more information, see What Is the Active Directory Schema?: Active Directory.
The Schema Admins group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-<root domain>-518 |
Type |
Universal (if Domain is in Native-Mode) else Global |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
Administrator |
Default member of |
|
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
Server Operators
Members in the Server Operators group can administer domain servers. This group exists only on domain controllers. By default, the group has no members. Memebers of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved.
By default, this built-in group has no members, and it has access to server configuration options on domain controllers. Its membership is controlled by the service administrator groups, Administrators and Domain Admins, in the domain, and the Enterprise Admins group. Members in this group cannot change any administrative group memberships. This is considered a service administrator account because its members have physical access to domain controllers, they can perform maintenance tasks (such as backup and restore), and they have the ability to change binaries that are installed on the domain controllers. Note the default user rights in the following table.
The Server Operators group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-549 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
Yes |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
Allow log on locally: SeInteractiveLogonRight Back up files and directories: SeBackupPrivilege Change the system time: SeSystemTimePrivilege Change the time zone: SeTimeZonePrivilege Force shutdown from a remote system: SeRemoteShutdownPrivilege Restore files and directories: Restore files and directories SeRestorePrivilege Shut down the system: SeShutdownPrivilege |
Terminal Server License Servers
Members of the Terminal Server License Servers group can update user accounts in Active Directory with information about license issuance. This is used to track and report TS Per User CAL usage. A TS Per User CAL gives one user the right to access a Terminal Server from an unlimited number of client computers or devices. This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
For more information about this security group, see Terminal Services License Server Security Group Configuration.
The Terminal Server License Servers group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
Note
This group cannot be renamed, deleted, or moved.
This security group only applies to Windows Server 2003 and Windows Server 2008 because Terminal Services was replaced by Remote Desktop Services in Windows Server 2008 R2.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-561 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Safe to move out of default container? |
Cannot be moved |
Protected by ADMINSDHOLDER? |
No |
Safe to delegate management of this group to non-Service admins? |
Yes |
Default User Rights |
None |
Users
Members of the Users group are prevented from making accidental or intentional system-wide changes, and they can run most applications. After the initial installation of the operating system, the only member is the Authenticated Users group. When a computer joins a domain, the Domain Users group is added to the Users group on the computer.
Users can perform tasks such as running applications, using local and network printers, shutting down the computer, and locking the computer. Users can install applications that only they are allowed to use if the installation program of the application supports per-user installation. This group cannot be renamed, deleted, or moved.
The Users group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
This security group includes the following changes since Windows Server 2008:
In Windows Server 2008 R2, INTERACTIVE was added to the default members list.
In Windows Server 2012, the default Member Of list changed from Domain Users to none.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-545 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
Authenticated Users INTERACTIVE |
Default member of |
Domain Users (this membership is due to the fact that the Primary Group ID of all user accounts is Domain Users.) |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
No |
Default User Rights |
None |
Windows Authorization Access Group
Members of this group have access to the computed token GroupsGlobalAndUniversal attribute on User objects. Some applications have features that read the token-groups-global-and-universal (TGGAU) attribute on user account objects or on computer account objects in Active Directory Domain Services. Some Win32 functions make it easier to read the TGGAU attribute. Applications that read this attribute or that call an API (referred to as a function) that reads this attribute do not succeed if the calling security context does not have access to the attribute. This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
The Windows Authorization Access group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
Note
This group cannot be renamed, deleted, or moved.
This security group has not changed since Windows Server 2008.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-32-560 |
Type |
Builtin local |
Default container |
CN=Builtin, DC=<domain>, DC= |
Default members |
Enterprise Domain Controllers |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Cannot be moved |
Safe to delegate management of this group to non-Service admins? |
Yes |
Default user rights |
None |
WinRMRemoteWMIUsers_
In Windows 8 and in Windows Server 2012, a Share tab was added to the Advanced Security Settings user interface. This tab displays the security properties of a remote file share. To view this information, you must have the following permissions and memberships, as appropriate for the version of Windows Server that the file server is running.
The WinRMRemoteWMIUsers_ group applies to versions of the Windows Server operating system listed in the Active Directory default security groups by operating system version.
If the file share is hosted on a server that is running a supported version of the operating system:
You must be a member of the WinRMRemoteWMIUsers__ group or the BUILTIN\Administrators group.
You must have Read permissions to the file share.
If the file share is hosted on a server that is running a version of Windows Server that is earlier than Windows Server 2012:
You must be a member of the BUILTIN\Administrators group.
You must have Read permissions to the file share.
In Windows Server 2012, the Access Denied Assistance functionality adds the Authenticated Users group to the local WinRMRemoteWMIUsers__ group. Therefore, when the Access Denied Assistance functionality is enabled, all authenticated users who have Read permissions to the file share can view the file share permissions.
Note
The WinRMRemoteWMIUsers_ group allows running Windows PowerShell commands remotely whereas the Remote Management Users group is generally used to allow users to manage servers by using the Server Manager console.
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
Attribute |
Value |
|---|---|
Well-Known SID/RID |
S-1-5-21-<domain>-1000 |
Type |
Domain local |
Default container |
CN=Users, DC=<domain>, DC= |
Default members |
None |
Default member of |
None |
Protected by ADMINSDHOLDER? |
No |
Safe to move out of default container? |
Yes |
Safe to delegate management of this group to non-Service admins? |
|
Default User Rights |
None |