Default Domain Groups

The Active Directory service in Windows Server 2003 configures the Windows Server 2003 computer as a domain controller. The Active Directory service creates default groups to configure and manage the domain. The default groups are created under built in and the users container in the Active Directory Users and Computers console. In addition, the Active Directory service also creates default domain groups under Active Directory Users and Computers console. You can move the groups, under Users container, from one location to another.

Domain Groups under Built in container
You cannot move the groups, under built ins, from one location to another. The default domain groups under built ins container are:

> Administrators - Enables complete and unrestricted access to the domain controller. The members of the Administrator group can manage users in the domain. The administrators can add, delete, and move users and groups in the domain. The Domain Admins and the Enterprise Admins are the members of the Administrators group.

> Operators - Enables to administer domain user accounts and groups. The members of this group own the permissions to log on locally to the domain controller and shut down the domain controller. However, they are restricted from modifying the administrators and Domain Admins group.

> Backup Operators - Enables to perform backup and restoring files and folders on the domain. The members of this group override the deny permissions of other groups for the backup and restore process. The members of this group also possess the rights to log on locally to the domain and shut down the domain.

> Guests - Assigns very restricted rights to the members. The members of this group have read only access on the domain and network resources. The members in the guests group are further restricted access to critical system areas, such as, % System Root % drive and the system properties.

> Network Configuration Operators - Enables users to modify the network configuration, such as TCP/ IP settings on the domain. The members of this group are assigned administrative privileges to modify the network settings.

> Print Operators - Enables users to manage printing operations on the domain controller in the domain. The printing operations include tasks, such as, installing and configuring, and sharing printers. The members of this group can log on locally and shut down the domain controller.

> Remote Desktop Operators - Enables users to remotely access the domain controller. By default user are not permitted to access the domain controller from a remote location. The members of the remote desktop operators group override the permissions to remotely access the domain controller.

> Server Operators - Enables to execute administrative tasks on the domain controller. The administrative functions include tasks, such as, creating shares and managing services. The server operators can also shut down the domain controller on a domain. However, the server operators do not possess the administrative privileges on the domain.

> Users - Enables the users of the group to execute common tasks on the domain, such as running applications, using printers and network shares. The users are restricted from making changes to the
system configuration on the domain controller.

> Incoming Forest Trust Builders - Enables to create one-way trust relationships between domain,controllers in the domain.

> Replicator - Enables the users of the group to execute replication tasks, such as file and folder replication on the domain controller.

Domain Groups under Users Container

In addition to the built ins container, Windows Server 2003 also provides default groups under Users in the Active Directory Users and Computers console. They are:

> Domain Admins - Enables complete access to the domain controller on the domain. This group is a member of the Administrators group by default.

> Domain Computers - Contains all the clients and servers attached to the domain controller in the domain. The computer becomes a member of the Domain Computers group when you attach a computer to the domain.

> Domain Controllers - Contains all the domain controllers in the domain. A domain can contain more than one domain controller. All the domain controllers in the domain are added to the domain controller group by default.

> Domain Users - Contains all the domain users on the domain. All the domain users in the domain are added to the domain users group by default.

> Enterprise Admins - Enables complete and unrestricted access over the domain controller in the domain. The Enterprise Admins group is a member of the administrators group by default.

> Schema Admins - Enables the members of the group to modify the schema. The Active Directory on a domain controller consists of a schema. The schema contains configuration information about the
Active Directory service. The members of the Schema Admins group possess the rights to modify the schema of the Active Directory on the domain.

> Cert Publishers - Possess permissions to issue digital certificates for Users and Computers. There are no default users in the Cert Publishers group.

> Group Policy Creator Owners - Determines the security level for the group. Members of the Group Policy Creator Owners possess the permissions to create and modify the group policy for any object in
the domain controller on the domain.

> Domain Guests - Contains all the guests accounts in the domain. Every domain has a guest account.The domain guests group contains user accounts of the domain guests. All the domain guests in the domain are added to the domain guests group by default.

> RAS and lAS Servers - Possess permissions to access the remote properties of the domain controller in a domain.