Administrator added to all groups (one for 2k3 admins)

[shocker-z]

Has anyone come across administrator being added to all groups on Windows 2003 server and windows 2003 SBS?

In total we have had 5 clients now where the administrator account has been added as a member of EVERY group in active directory and oviusly it cuts down admin writes right down to not being able to view Event viewer.

Is this an update gone wrong or somthing more serius?

Regards
Liam


EDIT default group changes also

Edited by shocker-z on Wednesday 20th December 12:11

[sneakyneil]

Odd

I'm looking at a standalone (i.e. non-AD) 2K3 standard server here, set up the other week. Its patched up to date and has IIS, MSDE and something called Winscribe running on it, Administrator is a member of the Administrators group and no others.

Did the same person set up all 5 servers?

[shocker-z]

nope that's the thing, there not newly set up some have been running for years and all of a sudden this has started happening :S


Liam

[sneakyneil]

Oh well at least it's easy to fix

[BliarOut]

Sounds like human interaction to me.

[shocker-z]

This time it was.. Last time it wasn't as we had no backup account and we couldn't modify active directory or server management

[thepassenger]

BliarOut said:

Sounds like human interaction to me.

Agreed, find out who's been playing and nuke em. I've not seen Administrator appear in any other groups unless someone has put them there... although why you'd want to do that I'm not sure as the Admin group is pretty much "go anywhere, do anything" in terms of permissions.

Unless... make sure some numpty hasn't removed the Admin user from 'something' (a file share, etc) and desperatley tried to fix it.

[sneakyneil]

Maybe a script has gone pete tong? Obvious question I know but is there anything like that in common?

[shocker-z]

BliarOut said:

Sounds like human interaction to me.

Yeah that's what we're beginning to think as i've not been able to find anything about this anywhere on the net.

The main problem is that the default group gets changed also.

sneakyneil, unfortunately no there isn't just a script that runs to do anything like that. someone must have taken time to do this really as 45 groups were added to the last client!


Liam

Edited by shocker-z on Wednesday 20th December 15:12