Domain Admins have Send As feature by Default?

We have discovered that all our Domain Admins can utilise the "send as" feature and send on behalf of any other user, by default. How do we go about resolving this, so that this is not the case anymore?

Clarify: “Domain Admin” has “Send As” right to all mailboxes
Collect unmentioned info:
Version: windows server, exchange [03/07]?
Notes: domain admin has “send as” right by default in ex07, but based on your description, it seems to be ex2k3, right?
Troubleshooting:
1.     Add a registry in HKEY_CURRENT_USER\Software\Microsoft\Exchange\EXAdmin
Type: REG_DWORD
Name: ShowSecurityPage
Data: 1
2.     Check the permission in ESM
a.     Right-click your org icon on the top level of ESM
b.    Go to “Security” tab
c.     Check permission on “Domain Admin” is ok.
d.    Also check your “Server” and “Mailbox” objects, make sure the “Allow the inheritable permissions to propagate..” has been checked
3.     Run Domainprep to make sure that everything is ok at the permission
PS: Wait until all the permissions propagate to child objects

Similar Messages

Prevent Active Directory Parent Domain Admins from accessing Child Domain

We want to prevent Parent domain administrators (or a similar profile?) from accessing and/or administering child domains. Is this possible, or do parent domain admins have irrevocable administrative access to any child domain?
Asked another way, can a restricted profile be configured for administration of the parent domain that does not cross domain boundaries effectively isolating each domain's administrative needs?
Thanks in advance for input and advice!
Best regards.

Sorry, I was replying again after I read your second paragraph. The parent domain is the Forest root. we have parentdomain.com
parent.parentdomain.com
child1.parentdomain.com
child2.parentdomain.com
child3.parentdomain.com
We do not want the Domain Administrator for parentdomain.com to be able to administer, or preferably, even access the Child Domains.
1.) Can we remove that user from "Enterprise Admin" role and assign a different role so that they can only administer parentdomain.com (effectively demoting that user)?
2.) Promote a Child.parentdomain.com user to Enterprise Admin?
Thanks sorry for the confusion.
Ah ok.
Yes, you can. the answer is the same basically. The group membership is what counts. So in the child domain, remove the enterprise admins group from the child domain admins groups. OR make sure the domain admins of the forest root are not members of the
enterprise admins group. that way they are still only admins in the parent domain.
It is really only depending on group members ship and including those groups in the child domain. by default the enterprise group is included for example, but nothing stops you from removing those groups.
based on the group membership you can also deny them the ability to log on.
the only thing you cannot prevent is the forest administrator account from doing something.
One thing I would like to add though: any admin in the forest domain likely has the ability to still get access if he wants to force his way in.

New security group then added into either built in administrator or domain admin group

I am having windows 2012 R2 DC so i need to create administrator group please let me know if we create new security group then added into either built in administrator or domain admin group it will work? i have tried but not working any other alternative
methods to get admin access

Controlling local group membership could be done by GPOs:
Using Group Policy Restricted Groups: http://social.technet.microsoft.com/wiki/contents/articles/20402.active-directory-group-policy-restricted-groups.aspx
Using a startup script that adds a domain group as member of a local group: http://technet.microsoft.com/en-us/library/bb490706.aspx
If you have manually added a domain security group to local Administrators group of a computer and you still see that the members are not admins then you can do the following:
Logoff and logon again and see if that helps
If you are using a universal group then you be having a problem with the membership. More details here: http://www.windowsdevcenter.com/pub/a/windows/2004/06/15/fsmo.html. You can try converting the group to a global one for testing.
Adding a user to Domain Admins group will make you, by default, a local administrator on domain-joined Windows Systems. This is because, domain admins are, by default, members of local Administrators group. However, you should make the membership of Domain
Admins group very limited and only for users who do global domain administration.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Domain Admin locked out of local logon

I have a customer we just took over for. They have an existing issue where the domain administrator cannot log in locally to the DC. I've looked through all their GPOs and cannot find any instance of the domain admin groups being specially being denied this
right. In fact, it says right in the DC GPO that domain admins have the rights for local log in yet I can't seem to log in. Remote desktop works fine and that is how I've been accessing their DC but I cannot find an answer to this problem. Any ideas?

Policy Computer Setting
Source GPO
Access Credential Manager as a trusted caller
Not Defined
Access this computer from the network kcengr\IWAM_DELL-OFV7446Y6N,Everyone,kcengr\IUSR_DELL-OFV7446Y6N,kcengr\IWAM_DELL-OFV7446Y6N,Administrators,Authenticated Users,ENTERPRISE DOMAIN CONTROLLERS,Pre-Windows 2000 Compatible
Access,kcengr\IUSR_DELL-OFV7446Y6N,kcengr\IIS_WPG
Default Domain Controllers Policy
Act as part of the operating system kcengr\bkupexec
Default Domain Controllers Policy
Add workstations to domain Authenticated Users
Default Domain Controllers Policy
Adjust memory quotas for a process NT SERVICE\MSSQL$SCANMAIL,IIS APPPOOL\Classic .NET AppPool,kcengr\IWAM_DELL-OFV7446Y6N,LOCAL SERVICE,NETWORK SERVICE,kcengr\IWAM_DELL-OFV7446Y6N,Administrators,IIS APPPOOL\DefaultAppPool,NT
SERVICE\SQLAgent$SCANMAIL Default Domain Controllers Policy
Allow log on locally kcengr\IUSR_DELL-OFV7446Y6N,Administrators,Backup Operators,Account Operators,Server Operators,Print Operators,kcengr\IUSR_DELL-OFV7446Y6N,kcengr\IIS_WPG
Default Domain Controllers Policy
Allow log on through Remote Desktop Services
Not Defined
Back up files and directories Administrators,Backup Operators,Server Operators
Default Domain Controllers Policy
Bypass traverse checking NT SERVICE\MSSQL$SCANMAIL,Everyone,Administrators,Authenticated Users,Pre-Windows 2000 Compatible Access,NT SERVICE\SQLAgent$SCANMAIL
Default Domain Controllers Policy
Change the system time Administrators,Server Operators,LOCAL SERVICE
Default Domain Controllers Policy
Change the time zone Not Defined
Create a pagefile Administrators
Default Domain Controllers Policy
Create a token object kcengr\bkupexec
Default Domain Controllers Policy
Create global objects Not Defined
Create permanent shared objects Default Domain Controllers Policy
Create symbolic links Not Defined
Debug programs Administrators
Default Domain Controllers Policy
Deny access to this computer from the network
kcengr\SUPPORT_388945a0 Default Domain Controllers Policy
Deny log on as a batch job Default Domain Controllers Policy
Deny log on as a service Default Domain Controllers Policy
Deny log on locally kcengr\SBS Remote Operators,kcengr\SUPPORT_388945a0,kcengr\SBS STS Worker
Default Domain Controllers Policy
Deny log on through Remote Desktop Services
Not Defined
Enable computer and user accounts to be trusted for delegation
Administrators Default Domain Controllers Policy
Force shutdown from a remote system Administrators,Server Operators
Default Domain Controllers Policy
Generate security audits LOCAL SERVICE,NETWORK SERVICE,IIS APPPOOL\Classic .NET AppPool,IIS APPPOOL\DefaultAppPool
Default Domain Controllers Policy
Impersonate a client after authentication Not Defined
Increase a process working set Not Defined
Increase scheduling priority Administrators
Default Domain Controllers Policy
Load and unload device drivers Administrators,Print Operators
Default Domain Controllers Policy
Lock pages in memory Default Domain Controllers Policy
Log on as a batch job kcengr\bkupexec,kcengr\IWAM_DELL-OFV7446Y6N,LOCAL SERVICE,kcengr\IUSR_DELL-OFV7446Y6N,kcengr\IWAM_DELL-OFV7446Y6N,kcengr\IIS_WPG,kcengr\SUPPORT_388945a0,kcengr\IUSR_DELL-OFV7446Y6N,kcengr\IIS_WPG,IIS_IUSRS
Default Domain Controllers Policy
Log on as a service kcengr\Administrator,NT SERVICE\MSSQL$SCANMAIL,kcengr\SQLServer2005SQLBrowserUser$KC01,IIS APPPOOL\Classic .NET AppPool,kcengr\bkupexec,NETWORK SERVICE,IIS APPPOOL\DefaultAppPool,SYSTEM,NT SERVICE\SQLAgent$SCANMAIL
Default Domain Controllers Policy
Manage auditing and security log kcengr\Exchange Servers,kcengr\Exchange Enterprise Servers,Administrators
Default Domain Controllers Policy
Modify an object label Not Defined
Modify firmware environment values Administrators
Default Domain Controllers Policy
Perform volume maintenance tasks Not Defined
Profile single process Administrators
Default Domain Controllers Policy
Profile system performance Administrators
Default Domain Controllers Policy
Remove computer from docking station Administrators
Default Domain Controllers Policy
Replace a process level token NT SERVICE\MSSQL$SCANMAIL,IIS APPPOOL\Classic .NET AppPool,kcengr\IWAM_DELL-OFV7446Y6N,LOCAL SERVICE,NETWORK SERVICE,kcengr\IWAM_DELL-OFV7446Y6N,IIS APPPOOL\DefaultAppPool,NT SERVICE\SQLAgent$SCANMAIL
Default Domain Controllers Policy
Restore files and directories Administrators,Backup Operators,Server Operators
Default Domain Controllers Policy
Shut down the system Administrators,Backup Operators,Server Operators,Print Operators,SYSTEM
Default Domain Controllers Policy
Synchronize directory service data Default Domain Controllers Policy
Take ownership of files or other objects Administrators
Default Domain Controllers Policy
I am using the domain administrator account to try and log on locally and I cannot see a reason within the DC's GP why it would be prevented.

Remove Send-As for domain admin groups

With referring to below link.
http://social.technet.microsoft.com/Forums/exchange/en-US/d2e97e64-536a-4c46-8e57-e0ac6a4ad64e/how-do-i-remove-domain-admins-send-as-settings-for-all-users?forum=exchangesvradminlegacy
The solution work perfectly for normal user but for user whose member of Domain Admin as well, the send-as will revert back from Deny to Allow after a while.
I have a user who member of domain admins group, say User A. Since we want to remove the send as for all users (including User A), I did followed the steps, Denied Send-As for Domain Admins group for User A.
However, after for while it return back to Allow.

The permissions on members of special groups is managed by the AdminSDHolder and SDProp.
http://technet.microsoft.com/en-us/magazine/2009.09.sdadminholder.aspx
The way to deal with this is to give your domain admins (and any other admins) a separate account and to remove their "normal" account from any privileged groups (and to reset the adminCount property and "allow inheritance" on the "normal" account). Do NOT
give the admins a mailbox.
If you can't do that, then deny the Domain Admins group the "Send As" and "Receive As" permission at the organization level in the AD's configuration container. Use ADSIEDIT to do that here:
CN=<Organization>,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<domain>,DC=<tld>
--- Rich Matheisen MCSE&I, Exchange MVP

Domain Admin doesn't have local Administrator privileges

This was all done using Azure VMs.
machine: server-dc
Setup Windows 2012 R2 as a domain control with user 'testadmin'
Domain: DEV
Added a user 'domainadmin' and made a Member of all the same groups as testadmin (including Domain Admins)
machine: server-a
Setup Windows 2012 R2 with user 'localadmin'
Joined server-a to the domain
"DEV\Domain Admins" was automatically added to the local Administrators group
Login to server-a as "DEV\testadmin"
- full local admin rights (because is member of "DEV\Domain Admins" - correct?)
Login to server-a as "DEV\domainadmin"
- does NOT have local admin rights yet is a member of "DEV\Domain Admins"
Why does "DEV\domainadmin" not have the exact same local admin rights on server-a that "DEV\testadmin" does?
Thanks,
Mike

I'm still having problems.
This account is in the local Administrators group so they should have permission to do these things. I've tried your work around but still no luck.
User Account Control: Run all administrators in Admin Approval Mode
- Enabled (Default) is set
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
- Elevate without prompting is set
Machine rebooted
UAC in Control Panel set to Never notify
To clarify:
User 'domainadmin' is a user created on the DC.
Group 'Domain Admins' is a group created on the DC.
'domainadmin' is a member of 'Domain Admins'
'Domain Admins' is a member of the local Administrators group on SERVER-A
So 'domainadmin' is in essence a member of the local Administrators group on SERVER-A.
YET:
When logged in to SERVER-A as 'domainadmin', from a command prompt:
c:\del test.txt (a file created by 'localadmin')
Access is denied.
c:\iisreset
Access denied,
This user is a member of the local Administrators group - why can he not function as an Administrator?

Windows Server 2012 R2 non-default domain admin limitations

Enivronment: Windows Server 2012 R2Problem: members of Domain Admins group are restricted in ways the default domain admin account is not. This is with or without UAC disabled; there are even more prompts with UAC enabled. Here are two examples:Attempt to copy to Public Desktop. Built-in domain admin or local admin account can do so without restriction; any other member of Domain Admins group is prompted for administrator permission (although clicking Continue proceeds without actually requiring further authentication/permission)Right-click -> Properties of hard drive in Explorer is missing Shadow Copies tab for non-default Domain Admin. Yes, I can simply right-click the drive and go to Configure Shadow Copies, so this one is not so important. But it is an inconsistency that means I have to access things just a bit differently...
This topic first appeared in the Spiceworks Community

I have already replied to that here: https://social.technet.microsoft.com/forums/windowsserver/en-US/b57abf72-90e6-44d7-93a5-0e57cb5404c9/nic-teaming-with-ws2012-ad
I still do not see an MS statement saying that it is supported for DCs.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

I am unable to Send E-mail via Default mail app in my iphone. IOS7, i have account of icloud, Gmail, Microsoft all the account are well added, i can recieve e-mails but the massage i send is never sent

I am unable to Send E-mail via Default mail app in my iphone. IOS7, i have account of icloud, Gmail, Microsoft all the account are well added, i can recieve e-mails but the massage i send is never sent

Turns out this was a simple set up error for me, although i'd set up mobile me to sync my e mails I had never set up my outgoing message server. Therefore, if I received a message from me.com I could reply no problem, however if the message came from aol.com I couldn't reply.

User Accounts in Domain Admins group do not have full administrative rights to the server

Our server was fine until recently one day we lost admin access for admin user accounts. If we log in to the server with the Domain Admin account, this account has full admin access to the server and can install and launch all programs and even all server
admin tools. If we log into the server with a user account which is in the Domain Admins group, that account cannot install software or launch Services.MSC. Even IE will not load any page and crash with a "Not Responding" Error.
The server has no viruses we even ran SFC /SCANNOW and it did repair from corrupted files but that didn't fix the issue.
Any ideas?

Hi Rick,
May be UAC is blocking installtion. Have it disabled and see if it helps. Ensure you have domain admin groups added into local administrators group.
Alos Check these links please.
https://social.technet.microsoft.com/Forums/en-US/b5300f28-6a2a-4760-8b80-97a2da0f87c1/2012-domain-admin-user-cannot-install-programs-on-a-domain-windows-7-pc?forum=winserverDS
https://social.technet.microsoft.com/Forums/en-US/0ca040de-52ac-4259-bf78-c22436fd04d4/domain-users-with-domain-admins-right-cannot-install-programs-or-open-server-manager?forum=winserverDS
Thanks,
Umesh.S.K

Office 2013 will not open unless user is a Domain Admin

In order to get the Office 2013 suite to install from Office 365, I had to make all the users (115 in 4 offices) a domain admin, we then installed the software on everyone's computers and we have migrated our email. However, I now need
to remove all the users from being a domain admin, but when I do none of Office programs will open, no error message, just a spinning wheel for 10 seconds and nothing. I need to remove the users from being a domain admin as they can now see
network drives that they were previously restricted from. All computers are Windows 7 Pro. I have even installed the suite on a brand new computer, installed as admin, login as a domain user and nothing will open.
Thanks

What's the default right for the user in your domain, domain user?
Can we open the Office application when the domain user is in local administrator group?
Please turn off all of security programs and 3rd-party programs (Windows clean boot) and then launch Office component, such as Word.exe with safe mode. ("Winword.exe /safe") to check if it opens successful in non-domain user rights.
Don't use Office shortcut to open Office but double click the .exe file under %programfiles%\Microsoft Office to check if the office process appears in Windows Task Manager.
In addition, please go to eventvwr to check if there is any errors regarding to permission or Office exist. If so, post it here for further checking. Thanks.
Tony Chen
TechNet Community Support

DFS - The replication group cannot be created - insufficient permissions - NOT DOMAIN ADMIN, LOCAL ADMIN

Hi,
I am trying to setup DFS replication on tow servers. I am local admin on the servers but NOT domain account. Is it possible to create Replication group anyway? or should i contact the Domain administrator to the job?
Thanks

Hi,
We cannot use local administrator to create a dfs replication group. By default, Domain Admins group can create a dfs replication group. You could also delegate to a user or group the ability to create replication groups and the user must add to the local Administrators
group on the namespace server.
For more detailed information, please refer to the article below:
Delegate the Ability to Manage DFS Replication
http://msdn.microsoft.com/en-us/library/cc771465.aspx
Best Regards,
Mandy
If you have any feedback on our support, please click
here .
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

SQL Windows Authentication with Login of AD Group 'Domain Admins'

Having a bit of a difficulty with Microsoft SQL Server 2012 windows authentication integration...
The server is setup to have Windows authentication used as its means of login authentication. No issues with this other than a strange error that occurs on multiple SQL servers in our domain:
When a login is created for domain group "[domain]\Domain Admins", users within this AD group cannot connect to the SQL server through the Management Studio. The error that SQL server gives is Error 18456, Sate 11, i.e. "Valid login but server
access failure"
However when a different AD group is added as a login (like [domain]\[group]), users from this group can successfully log into SQL server. It seems that adding any other group, even groups from a different domain, grants successful authentication as I would
expect EXCEPT the AD group 'Domain Admins".
Is there some restriction/security feature at play here on this AD group that makes using the 'Domain Admins' group as a login not possible?
Andrew

Yes, this group was removed and readded just yesterday to try to fix the issue.
Here is the output of the command:
class
class_desc
major_id
minor_id
grantee_principal_id
grantor_principal_id
type
permission_name
state
state_desc
105
ENDPOINT
2
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
3
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
4
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
5
0
2
1
CO
CONNECT
G
GRANT

Group Policy changes cause Access Denied error for Domain Admin account

Hi All,
I am battling to get WSUS to work, and I think the route cause is problems editing the domain and domain controller group policy objects.
We have 1 DC, approx 20 clients. 1 GPO for DC, 1 GPO for clients. Ther e is a link to the default domain GPO in our staff (users) OU, I don't know if it should be there or not.
I log in as domain administrator, right-click the domain GPO in GPMC, click Edit.
Find the setting I want to edit (specify intranet microsoft update service location), double click.
Change something, click OK.
I get error:
Unhandled exception has occurred in a component in your application. If you click Continue, the application will ignore this error and attempt to continute.
Access is denied. (Exception from HRESULT: 0x80070005
(E_ACCESSDENIED)).
I have followed the steps in the links posted by Brent in another post called: "restricting-domain-admin-account-to-edit-group-policies" (no links allowed for my account yet sorry) and the user does have edit settings, delete, modify security delecation.
PLEASE NOTE: the solution may very well be something very simple/basic. I am reasonably computer savvy, but have just upgraded the whole network for an NGO on a voluntary basis. Never seen a sever before I came here, but I'm the best they have. Please bare
that in mind when offering advice :)
Any help appreciated!
James

More diagnostic info:
Inside GPMC, there's Group Policy Results.
If I right-click, Result Wizard, choose this computer, it works fine showing default domain controllers policy with alert that it's enforced.
If I browse for another PC (it comes up as Domain\PC name), click Next, I get error:
Failed to connect to DOMAIN\PCNAME due to the error listed below. Ensure that the Windows Management Instrumentation (WMI) service is enabled on the target computer, and consult the event log of the target computer for further details.
Details: the RPC server is unavailable.
If you need the recent related events, I will post them. I also checked that service on the client - it's automatic and started.
PPS Clients are all Win 7, PCs are 32bit, laptops are 64. Server is Windows Server 2012 Datacenter. WSUS when clicking Help -> About from the snap-in/GUI: 6.2.9200.16384.
PPPS Directory browsing for the whole WSUS object in IIS is enabled, thanks to SorinAlbu over at Spiceworks post WSUS and IIS.
PPPPS Launching IE and loading http://servername:8530/iuident.cab fails 404 error from both clients and server. That file in C:\Program Files\Update Services\WebServices\Root\iuident.cab doesn't exist. Maybe because we recently removed the WSUS role and reinstalled
it, to check if something went wrong the first time? It's all been configured using the snapin/GUI, but the new installation of the role hasn't yet connected to the Microsoft Update servers.
PPPPPS Added the Application Server role with default settings as recommended by the step by step guide to WSUS at Technet. Still no dice.

Domain Admin access to workstations

A relatively simple question yet I haven't found any firm answers.
We have a 2008 R2 domain with all 2008 R2 servers/DC's running Windows 7 workstations. I want to know if a user that is a member of the domain admin security group has LOCAL admin access to any workstation that is joined to the domain
BY DEFAULT (no GPOs applying, no scripts running at logon, etc)?

Hi,
to my knowledge and observation the domain admins group is always added to the local administrators group as part of the domain join process. So yes, domain admins are local admins unless do something against it.
Regards,
Lutz

How to edit classpath for Domain Admin Server?

Hi!
Please, explain me how can I edit the classpath settings for Domain Admin Server of Sun java Application Server 8.2?
I need to remove some classpath made by application installer in order to make the application work.
It is said in documentation that I have to login to DAS first, but I can't see how can I make it through Server's web-interface :(

Hi Rengasamy,
If you want to set the CLASSPATH for all the managed Servers available in your Domain then "$DOMAIN_HOME/bin/setDomainEnv.sh" has an Environment variable with name "PRE_CLASSPATH" which is usually preferred for Patches or any JAR which we want to override from the WebLogic's existing classpath.
But if you don;t want to override WebLogic's default CLASSPATH rather include your Jars in it then please add your JAR filenem including absolute path inside the "POST_CLASSPATH" variable inside "$DOMAIN_HOME/bin/setDomainEnv.sh"
Apart from this another option will be putting your Jars inside the "$DOMAIN_HOME/lib" directory because The jars located in this directory will be picked up and added dynamically to the end of the server classpath at server startup. The jars will be ordered lexically in the classpath. The domain library directory is one mechanism that can be used for adding application libraries to the server classpath. It is possible to override the $DOMAIN_DIR/lib directory using the -Dweblogic.ext.dirs system property during startup. This property specifies a list of directories to pick up jars from and dynamically append to the end of the server classpath using java.io.File.pathSeparator as the delimiter between path entries.
If you are starting your Managed Servers using NodeManager then please refer to the following Article.:
Topic: Nodemanager Based ManagedServers setting MEM_ARGS
http://middlewaremagic.com/weblogic/?p=780
Regards
Ravish Mody

Domain Admins have Send As feature by Default?

Similar Messages

Maybe you are looking for