1 reply to this topic

[Chelley]

Anybody know the difference between the Domain Admins group and the Administrators group on Windows?

We're having problems in uninstalling and upgrading when installed by members of one group but upgraded/uninstalled by a member of the other group.

Any ideas?

Michelle
P.s. this is a follow on from an earlier posting

[Glytzhkof]

I am no expert on this subject, but I believe the difference is that the local administrators are defined in the local security database on each workstation (SAM), whereas the domain admin accounts are defined in active directory (and authenticated via the kerberos protocol).

I think that in most cases domain admin accounts are added to the local admin group on each workstation so that domain admins always have admin rights wherever they log on, but if something has been changed in the workstation's local security database I guess it could be that the domain admin won't have full admin access.

Again I am no expert here, but if I were you I would check whether the domain admin group has somehow been locked out from the local admin group.

On another note: admin rights is not actually required to run MSI installers. MSI is capable of using "elevated rights" which means that a regular user can invoke an approved MSI file that is then installed with admin rights.