Creating a Domain Global Group Called Member Computer Local Admins

Q: A consultant for our company gave a computer Domain Admin rights in Active Directory (AD); he said it's necessary when pushing out Microsoft Systems Management Server (SMS) to clients. Is that true?

A: I don't recommend adding your SMS site server’s computer account to Domain Admins. The SMS site server doesn’t need Domain Admins authority; it just needs local administrator authority on computers in the domain in which it will be installing the SMS client. Making the SMS site server or any other server or application a member of Domain Admins is a quick way to give computers and their administrators access to each computer in the domain, but it also gives them access to AD. The principle of least privilege dictates that you never give people more authority than is necessary to do their jobs, and giving users Domain Admins authority can cause huge problems both through honest mistakes or malicious behavior.

The best way to handle this situation is to create a new domain global group called Member Computer Local Admins. Make computers that need administrator authority to other systems in the domain members of the Member Computer Local Admins group. . . .