70-292_01.QXD 8/21/03 12

271_70-292_01.qxd 8/21/03 12:40 PM Page 1010 Chapter 1 • Managing Users, Computers, and Groups

Default Groups

Several default groups are created during the creation of an Active Directory domain.These

groups should be used as much as possible to control access to shared resources and to grant

rights to perform specific administrative tasks. Many of these default groups are assigned a

specific set of user rights that allow group members to perform the tasks for which the

group was created. For example, any user that is a member of the Backup Operators group

will have the right to perform backup and restore operations for domain controllers, even

though they might not otherwise be able to perform this task.

The default groups are created in two places in Active Directory: the Builtin container

and the Users container. Figure 1.1 shows the Active Directory Users and Computers con-

sole; from this location the network administrator can perform all group, user account, and

computer account management tasks (discussed later in the “Managing and Modifying

Groups” section of this chapter).

Figure 1.1 The Active Directory Users and Computers Console

Table 1.2 details the default groups that are created in the Builtin container.

Table 1.2 The Default Groups Located in the Builtin Container

Group Name Group Function

Account Operators The members of this group can create, modify, and delete

user accounts, computer accounts, and groups located in

the User or Computers containers and all Organizational

Units in the domain except for the Domain Controllers

Organizational Unit. Account Operators cannot make any

changes to the Administrators or Domain Admins groups,

and they cannot make modifications to members of

these groups.

Administrators The members of this group have full and complete control

over all domain controllers in the domain. The Domain

Admins and Enterprise Admins groups are members of

the Administrators group by default.

Continued

https://traloihay.net