RE: Administrator in Domain Admins group

If you fear it's been compromised, just change the password.  The important=
 point to note is that anyone with domain admin credentials can simply modi=
fy the password of that account at any time, just as anyone with domain adm=
in credentials can great a dummy account, futz about, and then delete it.  =
If you have no live auditing tools (like me), it'll likely be missed.

The obvious thing to note here is that if you have any other systems relyin=
g on that administrator account for credentialing, changing the password wo=
uld break that.  Try as I might, just when I think I've removed its use fro=
m every system I have, I find another thing I didn't know someone used it f=
or.  We have a problem with domain admins as well... problem is that they'r=
e actually granted those permissions intentionally.  *sigh*

MS's guide to securing the AD Admin account recommends renaming it to a bog=
us user account name.  : http://technet.microsoft.com/en-us/library/cc70083=
5.aspx=20

-----Original Message-----
From: [email protected] [mailto:[email protected]] On=
 Behalf Of Shang Tsung
Sent: Monday, January 31, 2011 7:58 AM
To: [email protected]
Subject: Administrator in Domain Admins group

After an audit, I noticed that in the Domain Admins group of our domain, th=
ere is an account named Administrator. As my engineers told me, this accoun=
t is created by default when you create a new domain and cannot be deleted =
or disabled. Is this true? I am not convinced yet.

We do not like general purpose accounts like this because we lose accountab=
ility. I am pretty sure the password of that account is in the hands of peo=
ple who are not supposed to have it. Each domain admin has his own account =
who is in the Domain Admins group, so there is no need for this Administrat=
or account.

Can we delete it? And if yes, what would be the consequences?

Thanks,
Shang Tsung