Deleting system administrators group

Hi
Whenever I create organization i can see System Administrators as Administrative Groups automatically by default. I am not able to delete this group as the GUI says deletion is not supported.
But i would like to delete this group and want to assign new admin group. How to delete system admin group?
Thanks in Advance

Well, that's not recommended. You may face problems in other functionalities.
Don't even try to do this.
You can do this from Database End only.

Similar Messages

MBAM System Administrators - Missing Manage TPM and Drive Recovery option - MBAM 2.5

I have installed MBAM 2.5 in a 3 server environment. Every thing is working fine and validated the installation.
But what I have found that the drive recovery tab and Manage TPM is missing for the users member of MBAM System administrators. As there are many changes that comes with MBAM 2.5 and one is exclusion of MBAM local groups.
Everything is perfect for the Advanced Helpdesk and Helpdesk users.
Gaurav Ranjan

Hi Gaurav,
As you mentioned, there are no local groups anymore. During configuration of the Admin portal, you specify AD groups for administration. We removed the System administrators group because it was kind of redundant. You could get the same
effect by adding the user to the Advanced Helpdesk and Reporting Users AD groups you specify. So, if you add whatever user you wanted to be the "system administrator" for MBAM to both of those AD groups, that should solve your problem. Note you
may have to log out of your machine and back in after adding them to the group so that they get the token, as with any AD group addition.

System administrators in windows group not in SQL DB - OutlookSoft 4.2 SP3

Using OutlookSoft 4.2 SP3
Has anyone every seen the case where you have users in the '<appset>SysAdms' windows server group that are not in the 'tblAppsetAccess' on the SQL DB? If so how and why does this occur? Are all system administrators stored in this table suppose to be in the group as well?

This can happen during the maintenace of users for appset.
Into 4.2 the sysadmin users are added into utilities web page.
So when you add an user to be sysadmin this is addded in both table and group.
But I think when you delete an users access from appset then the users still remain into Windows group.
I hope this will help.
Regards
Sorin

WSUS Administrators group and CleanUp error

Hi,
I try to do automatic cleanup of WSUS parent and downstream servers.
My script run fine with my account (domain admin) but I want to run the script with low rights.
So, I created a local account on each server, member of WSUS Administrators local group.
This works fine for Windows 2008 (R2) downstream servers but for 2012 Servers, i get an error: acces denied when performing cleanup.
After reviewing WSUS logs, it seems that it's impossible to stop WSUS Service with this account accros WSUS Remoting API.
Why WSUS administrators group isn't sufficient for 2012 R2 servers ?
Thanks.

Hi Steven,
My script is freely inspired by
this script
http://community.spiceworks.com/scripts/show/336-wsus-automatic-cleanup-script
I will publish it as soon as my account is validated (cannot copy code block...).
With the function $cleanupManager.PerformCleanUp([...]), it works on 2008 R2 servers but on 2012 R2 servers, I get this error:
System.Management.Automation.MethodInvocationException: Exception lors de l'appel de « PerformCleanup » avec « 1 » argument(s) : « Accès refusé » ---> System.ComponentModel.Win32Exception: Accès refusé
   à Microsoft.UpdateServices.Internal.BaseApi.SoapExceptionProcessor.DeserializeAndThrow(SoapException soapException)
   à Microsoft.UpdateServices.Internal.DatabaseAccess.AdminDataAccessProxy.StopWSUSService()
   à Microsoft.UpdateServices.Administration.CleanupManager.PerformCleanup(CleanupScope cleanupScope)
   à CallSite.Target(Closure , CallSite , Object , Object )
   --- Fin de la trace de la pile d'exception interne ---
   à System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception)
   à System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame)
   à System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
   à System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
I tried with the PS Module WSUS and function Invoke-WSUSCleanUp, but i get this error for ALL servers:
System.ComponentModel.Win32Exception (0x80004005): Accès refusé
   à Microsoft.UpdateServices.Internal.BaseApi.SoapExceptionProcessor.DeserializeAndThrow(SoapException soapException)
   à Microsoft.UpdateServices.Internal.DatabaseAccess.AdminDataAccessProxy.StopWSUSService()
   à Microsoft.UpdateServices.Administration.CleanupManager.PerformCleanup(CleanupScope cleanupScope)
   à Microsoft.UpdateServices.Commands.InvokeWsusServerCleanupCommand.ProcessRecord()
No idea what's the différence between this two functions...
But as you write above, an account in WSUS administrators group cannot stop service on 2012 server, nor on 2008 server !
I've searched the WEB but could not find anything speaking on a limitation for cleanup for WSUS administrators group.
Thank for your help.

Project Online - Schedule PDP disappearing for some Project Owners and Project Server Administrators Group

Current Project Online environment is currently setup with Project Server Permissions Mode. All projects follow a customized workflow that enables Schedule PDP on Planning Phase/Stage, among other rules. For some users the workflow and
expected PDPs are working fine, but for other the Schedule PDP just disappears under unknown conditions, even if they are part of the Administrators Group. Has anyone come across these behaviour?
Saludos!

As you said they belongs to Admin group it means they have required permission still double check the permission assigned to the users.
Also ask those users to try to log in form different system then check is issue is occurring.
If this issue is occurring for few users then this may be because of Browser. check the following :
1. Open IE then internet options --> Security --> Trusted Site and add your PWA site. then check
2. If still issue is occurring then click on F12 button then select browser mode as IE 9 then check.
kirtesh

Portal Error (A critical error...) after removing "Administrators" group

Hello experts,
I'm very new on the Portal topic and faced with an error on our portal environment (SAP ECC 6.0 and SAP Netweaver 7.01)
I've created a custom role with some worksets, folders and SAP standard delivered iView inside.
My portal dummy user is owner of this role. Furthermore he's assigned to the groups: "Everyone", "Administrators" and "Authenticated Users". The corresponding user in R/3 backend has SAP_ALL.
When I log-on to portal it's working fine, iViews, etc. are properly loaded. But thanks to the "Administrators" group, the user can access the tabs "Content Administration", "System Administration" and "User Administration" which should be obviously not the case. When I remove the group "Administrators" from the portal user, the 3 tabs are not displayed anymore. Therefore the iView from my custom role are not loaded any more. I get an error message in main screen saying "Critical Error. A critical error has occured. Processing of the service was terminated. Unsaved data has been lost. Contact your system administrator".
A colleague told me that it might be an issue on portal permission. I went via tab "System Administation" > "Permission" into the PCD and gave to my roles, folders and an example iView the following permissions:
- Name: Everyone; Administrator: Full Control; End User: checked
- Name: Authenticated Users; Administrator: Full Control; End User: checked
As I've used Delta Links I gave these permission to the SAP delivered iViews, too. Unfortunately the error stays the same.
Please advice what's missing.
Thank you so much, Jessica

Hi,
Thanks for your reply.
I started the NWA and went to Analysis > Debug > Logs and Traces.
There is a fatal error stated but the explanation is not very detailed:
Severity: fatal; Message: n/a; Category: /Applications/Xss; Location: com.sap.tc.webdynpro.progmodel.generation.DelegatingComponent; Application: sap.com/tcwddispwda; Host: pesap57; Node: Server 0 26_91224
The message is displayed twice (again: Severity: fatal; Message: n/a; Category: /Applications/Xss; Location: com.sap.tc.webdynpro.progmodel.generation.DelegatingComponent; Application: sap.com/tcwddispwda; Host: pesap57; Node: Server 0 26_91224)
These errors are not in the log when I add the Administrators Group.
Thanks for your advice, Jessica

Windows Administrators group privilege and behavior.

Hi,
I am trying to run the command remotely, net user username /domain , but it fails saying "System error 5". This behavior is seen as a domain user which is part of Administrators group, but not from any local administrators member.
I need help on the following.
1. I have seen that the Administrators group in Windows is very flexible. Any documentation links or samples how the privileges can be modified?
2. How i resolve the "System error 5" when the net command is run remotely as a domain user part of Administrators.
Thanks

Hi,
Here is a list about possible reason of this problem:
There is a time synchronization problem.
Permissions to access the remote computer (Share, NTFS, GPO) are missing.
A firewall or third-party product may eliminate the connection to the remote computer.
The computer account is disabled, has an expired password, or doesn’t exist in the domain.
There is an Active Directory replication problem.
Please access to the link below for more details and take its solution for reference:
https://support.microsoft.com/en-us/kb/555644
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

"Emergency role" for system administrators

Hello
Our SAP system administrators have more or less very comprehensive authorizations.
For emergency cases we are looking for a "near-by-SAP_ALL" role which the administrators are able to assign themselves.
Does anyone have experiences which considerations must be taken into account?
There is a list of possible transaction codes for administrators like this one:
http://www.sap-img.com/basis/useful-sap-system-administration-transactions.htm
But this list is not complete, the guys sometimes need more...
Any ideas
Thanks
BEO

careful. permitting admins to assign such a role to themselves may be a clear SoD violation not to mention an uncontrolled practice. emergency access is exactly what GRC Fireifghter is used for.
If you don't have it, then create a manual process that involves logging of all activities performed while the role was assigned, temporary assignment only, reviews and approval of logged activities. One way is to create a generic account that is always locked and is assigned to a user group that only certain people are allowed to maintain. Whenever the account is needed, it is "checked out" as if it was a firefighter. SM19 would be permanently set to log all activities for this account. To do this, you would have to close all loopholes to the process, such as tightly controlling who can change SM19 settings and who can unlock the account, who knows its password, and you would need periodic reviews of the account, showing the last time it was locked and password changed, the last time SM19 settings were change, and timely reviews of SM20 logs for the acocunt.
your auditors probably have suggestions for your emergency access procedure too.
good luck!

Deletion of Material groups

Hi all,
In the past we have created different material groups for each and every plant. Now we plan to standardize this for all of them.
I plan to change all old material groups to the new ones in the material master. This would update the info records, too.
I have to find a way to change the field in all POs and PRs.
Now my question:
Is there any impact with deleting the old material groups after that?
Do I need to pay regards to something else?
Thank you for your help
Tobias

Hi,
You can delete the Material group, but the system will not remove the old Material group from the Material master, PO, or any other documents untill you update the new material groups to the documents.
Table will also update with new material group once you update that.
rgds
Chidanand

Prevent Editing the Presentation Server Administrators Group

In OBIEE 10.1.3.4, I have created a Catalog Group "Second Tier Administrators" and grant it access to "Settings -> Administration -> Manage Presentation Catalog Groups and Users". How can I prevent the users in the "Second Tier Administrators" group from adding themselves to the "Presentation Server Administrators" group?

Hi Evaldo,
I don't see a way of you being able to edit one line without reading the entire file into memory. You could hold the data you are writing to the file in a custom table in SAP, and when an edit is required, delete the old table and recreate a new one based on your custom table.
Best of luck.
SL

Deletion of Price groups for Customers

Dear SAP SD Gurus,
I have a request from the Cusomter to Delete a List of the "Price Groups FOR Customers".
These Price Groups are already used in Various Sales Documents.
in such a Scenario, Would it be safe and advisable to delete the Price Groups?
i tried in a Training System, if the Price Group is deleted, and the Sales Document containing it is visited in change mode and he Specific field is stimulated, it gives Error in theDocument.
Eagerly Awaiting ur reply.
Regards,
Santa Khattri.
SAP SD Siemens IT Solutions.

Yeah,
If you delete these price groups from IMG Customization screen.
Then, if you have written any coding based on Pricing group will get effected,
If there are reports required based on pricing group, you will not get it.
So better would be, not to delete the price groups from IMG, instead remove it from the customer master from whom they are not required or relevant.
Do you have any problem, removing these field value from Customer Masters?

Builtin Administrators group membership auditing

Greetings,
Could please tell me what event ID in the security event log that refers to who changed the membership of the AD Builting Administrators group.
Thanks.
Redouane SARRA

Hi Redouane SARRA,
The
AD DS auditing events for each operation that are audited and appear in the Security event log are: event 5136 indicates the operation “modify”, event 5137 indicates the operation “create”, event 5138 indicates
the operation “undelete”, event 5139 indicates the operation “move”,
event 5141 indicates the operation “delete”.
Note: These events are displayed in Windows Server 2008 and 2008 R2. As Mike said, the event id depends on the version of the OS. If the OS you are running is not that, please
tell us.
In addition, it would be helpful if you can tell us the method that you use to audit the group changes.
For your information, please refer to the section Summary of new AD DS auditing events of the article
AD DS Auditing Step-by-Step Guide to get more help.
Regards,
Lany Zhang

Not a member of the Administrators group

My wife wants to use my iMac to do office work for her employer at home.
To do this, she has to install some employer software on my iMac. But when she tries to install her employers Mac software, she get the message "Hardware installation cannot start with this user account. Make sure that the user is a member of the Administrators group on the computer."
To make her a User/Admistrator, do I do the following:
1) Go into System Preferences and clicked on Users & Groups.
2) With the Current User as Admin checked, clicked on the padlock to unlock it and type in my password.
3) With the padlock unlocked, under Login Options, do I click on the + to establish a new user account for her?
4) Then, highlight the new account and click on the box "Allow user to administer this computer" and relock the padlock?
5) When the computer reboots, will it reboot with her as Administrator so she can load her employers software?
Once I have done this, in the future when she wants to use her new account, does she go into System Preferences - Users & Groups, unlock the padlock, click on her account to highlight it, relock the padlock and reboot the computer.
Thanks,
jzach52

Yes to 1 thru 5
To access the account it is faster just to logout and login rather than rebooting.

Programatically Check if the logged in user is in the Administrators group in Project Server (C#, VS2010)

Hi I would like to be able to check if the logged in user is a member of the administrator group programatically through c#
I know that I can get the user's GUID / check if they are actually a user in project server (resource table in reporting DB) but I am having trouble finding out how to programatically check if they are a member of the "Administrators" group.
Could somebody please provide a code sample of how to check if a user is in the administrators group when you have their GUID or username or name?
I did not see a table in the reporting DB that has this so I am guessing this has to be done through the PSI..
Thanks in advance!
BTW.. i am just wondering is there a way to check each groups permission levels? was wondering that if it is possible, what is the best way to implement a similar security model to that of the actual project server 2010

hi Amit :) I ended up finding the answer myself before you posted here but thank you for your reply anyways, it is basically the same thing that I did.
This is what I ended up doing :) Basically I have three different types of users configured in my web.config - admins, readwrite users, and read only users. In my code here I loop through and find out who the person is. Based on what group they are in I
can later show/hide different options in my application :)
SvcSecurity.SecurityClient security = new SecurityClient(ENDPOINT_PROJ_SECURITY);
string adminGroupsString = ConfigurationManager.AppSettings["adminGroups"];
string readWriteString = ConfigurationManager.AppSettings["readWriteGroups"];
string readOnlyString = ConfigurationManager.AppSettings["readOnlyGroups"];
List<string> adminGroups = new List<string>(adminGroupsString.Split(';'));
List<string> readWriteGroups = new List<string>(readWriteString.Split(';'));
List<string> readOnlyGroups = new List<string>(readOnlyString.Split(';'));
List<Guid> adminGroupIDs = new List<Guid>();
List<Guid> readWriteGroupIDs = new List<Guid>();
List<Guid> readOnlyGroupIDs = new List<Guid>();
List<Project> projectList = new List<Project>();
SqlConnection con = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["RDB"].ConnectionString);
con.Open();
SqlCommand command = new SqlCommand("SELECT * FROM MSP_EpmResource where ResourceNTAccount = @username", con);
command.Parameters.AddWithValue("@username", this.User.Identity.Name);
SqlDataReader reader = command.ExecuteReader();
if (reader.Read())
string resourceID = reader["ResourceUID"].ToString();
//Get a list of security groups
SvcSecurity.SecurityGroupsDataSet sgds = security.ReadGroupList();
//Get the IDs of the required groups
foreach (SvcSecurity.SecurityGroupsDataSet.SecurityGroupsRow ds in sgds.SecurityGroups)
if (adminGroups.Exists(group => ds.WSEC_GRP_NAME == group))
adminGroupIDs.Add(ds.WSEC_GRP_UID);
else if (readWriteGroups.Exists(group => ds.WSEC_GRP_NAME == group))
readWriteGroupIDs.Add(ds.WSEC_GRP_UID);
else if (readOnlyGroups.Exists(group => ds.WSEC_GRP_NAME == group))
readOnlyGroupIDs.Add(ds.WSEC_GRP_UID);
bool isAdmin = false;
//Go through each group using the id and check if the current
//user is in that group (for example here check if the user is an admin)
foreach (Guid id in adminGroupIDs)
SecurityGroupsDataSet group = security.ReadGroup(id);
foreach (SvcSecurity.SecurityGroupsDataSet.GroupMembersRow member in group.GroupMembers)
if (member.RES_UID.ToString().Equals(resourceID))
isAdmin = true;
Session["createReport"] = "true";
break;
//If the user is not an admin then continue checking who they are
if (!isAdmin)
bool readWrite = false;
//Check if the user is a read write group member
foreach (Guid id in readWriteGroupIDs)
SecurityGroupsDataSet group = security.ReadGroup(id);
foreach (SvcSecurity.SecurityGroupsDataSet.GroupMembersRow member in group.GroupMembers)
if (member.RES_UID.ToString().Equals(resourceID))
Session["createReport"] = "true";
readWrite = true;
break;
//If the user is not a read write group member either then check if they are a team member
if (!readWrite)
foreach (Guid id in readOnlyGroupIDs)
SecurityGroupsDataSet group = security.ReadGroup(id);
foreach (SvcSecurity.SecurityGroupsDataSet.GroupMembersRow member in group.GroupMembers)
if (member.RES_UID.ToString().Equals(resourceID))
Session["createReport"] = "false";
break;
Cheers! :)

Adding the Administrators group to a user token

I'm attempting to launch a process running with Administrator privileges from a service running on session 0. I'm using WTSQueryUserToken(WTSGetActiveConsoleSessionId(), ...) in my service (which runs as LOCAL SYSTEM) to get the user's token and then call
CreateProcessAsUser() to launch the process.
However, I need to add the Administrators group to the user token, but I'm severely intimidated by all the security API functions and I'm afraid I'll be adding something with unintended side effects.
What's the best way to get the same elevated token that a UAC prompt converts an ordinary user token into?

The Elevated token is stored in the user's token. The caller must have the SeTcbPrivilege and it must be enabled. You can call GetTokenInformation + TokenLinkedToken which will return a TOKEN_LINKED_TOKEN structure which contains the handle
to the Full token.
thanks
Frank K [MSFT]
Follow us on Twitter, www.twitter.com/WindowsSDK

Deleting system administrators group

Similar Messages

Maybe you are looking for