Home / server / Questions / 1095236
In Process
friendly joe
Asked: 2022-03-04 03:08:49 +0800 CST

Why are some groups in “groups” and some in “builtin”?

  • 772

can I move all of the default groups (and users) to → builtin? what’s the reason to have some of them in the groups/users folder. for example: “Allowed RODC Password Replication Group”.

active-directory

2 Answers

  1. The Builtin container is the default container for security groups that are prefixed with the builtin Domain SID S-1-5-32. The SIDs for a given builtin security principal are the same on every Windows system and does not contain the domain SID.

    The Users container is the default container for users and groups that aren't builtin.

    There's no reason to move any objects into or out of the Builtin container.

    https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers

    "SIDs for built-in accounts and groups always have the same domain identifier value: 32. This value identifies the domain Builtin, which exists on every computer that is running a version of the Windows Server operating system. It is never necessary to distinguish one computer's built-in accounts and groups from another computer's built-in accounts and groups because they are local in scope."

    • 1

  2. BUILTIN Groups are the original local groups of the first domain controller in the forest (which is why the "32" is in the SID). While all groups are in a sense local to the domain controllers, you'll find that these groups are essentially the "shared" local groups of the domain controllers. Over the years, more of these Domain Controller specific groups have been added (like the "Allowed RODC Password Replication Group")

    Examples:

    • adding a user to the BUILTIN\Remote Desktop Users group grants RDP access to the Domain Controllers
    • adding a user to the Remote management user group confers WinRM access to domain controllers
    • Print Operators?  That's printer management on domain controllers (which you should never ever be doing).

    That's the easiest way for me to understand.best way to think of them - generally, you should not be using these groups for anything else.

    As for whether or not they can be moved?  I generally leave the BUILTIN groups alone, but if you're really keen on cleaning up, consult this document which details for you which can, cannot be moved.  Heed this reference:

    https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-director...

    • 0