We're a small company that is growing pretty fast. For a long time there were 2 of us that were domain administrators. But over the past 2 years this has increased to 6 people and this strikes me as a bad idea as we grow further.

The direct cause of my query is this question. That solution requires that the domain admins that set access rights are fully trustworthy. And that only those trustworthy people can set the policy that restricts setting these access rights to the 2 people.

So, assume we have 2 people that are 100% trustworthy that have full domain admin rights. But these 2 people will rarely be doing the actual domain admin work, just the things we specifically want to restrict to just them.

For a company of 50 - 200 people, is there a common/recommended way to set this up? How best to do this and what rights are generally restricted to the 2 fully trusted people?

  • people that are 100% trustworthy- AFAIK nobody like that exists in reality. Trust, but verify. So you should have some kind of auditing system in place they cannot easily subvert or something similar.
    – Zoredache
    Commented Nov 5, 2015 at 23:33

2 Answers 2


A possible solution:

  • have two administrative accounts
    • one of them has a random password which is written down, sealed and stored in a safe place outside of the reach of the admins
    • the other one can be used only though two-factor authentication, one of the admins gets the password and the other one - the certificate
  • set up privileged accounts for normal administrative operations, shared between these admins (and more, if needed) together with strong auditing.

You now have a situation where

  • normal admin tasks are handled by selected people, what they do is tracked and they cannot modify these logs
  • exceptional admin tasks are handled by the two admins at the same time, when they are together
  • in extra exceptional cases you can get to the safe/bank, get the sealed enveloppe and access a full-fledged admin account.

You need to account for disasters (someone, or some people are not available) and for conspiracy scenarios (the two admins work together against you)


If you're a small company, 2 domain admins should be ample.

The description of Domain Admins from Technet is:-

Members of this group have full control of the domain. By default, this group is a member of the Administrators group on all domain controllers, all domain workstations, and all domain member servers at the time they are joined to the domain. By default, the Administrator account is a member of this group. Because the group has full control in the domain, add users with caution.

Source: https://technet.microsoft.com/en-us/library/cc756898(v=ws.10).aspx

That kind of control seems excessive so what you really need to do is have an audit, as a small business an informal one will do. Just list who requires which rights to what, why and assign them appropriately. Start from a principal of "least privilege" - everyone is a 'normal' user and what additional rights do they require to get their work done.

For example:- you might want someone to be able to change passwords but not install software or perform other administrative tasks, you can Delegate Control of the passwords without granting any other rights.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .