Join Log in
Score:0
avatar Server

Windows 10 Enterprise, PowerShell & logged on Domain Admin

gp flag
Gordon

Some years ago I ran in to a problem where PowerShell had limited functionality when logged in as a Domain Admin. Specifically PowerShell couldn't modify the LocalMachine hive or add/delete/modify files in Program Files. My understanding was the Microsoft REALLY doesn't want you logging in as a DA. You should remote in to your servers, not log in, and no work done on a workstation should ever require Domain Admin. I think the firm where this was happening was also using Enterprise Windows, rather than the Pro that most firms use.

Now I have a customer whose outsourced IT uses only Domain Admins for doing workstation installs. And while all of their production machines use Pro licenses, the VM they set up for me to test on has an Enterprise license of 21H2, because that's the license they had available.

So I have two questions...

1: Am I going to have issues with with this VM if I am logged in as a Domain Admin account and trying to run PowerShell locally? And if so, is this (still?) an Enterprise issue?

2: It seems to me that not using a Domain Admin account for doing workstation software installs is best practice. Why have multiple people with DA credentials that are technically not needed? I am not in a position to tell their outsourced IT how to do things, but I would like to know that my advice to others to NOT use a DA is well founded. Assuming I am correct in this, a pointer to a Microsoft white paper that I can then point people to would also be very helpful.

And, to clarify, I use PowerShell to automate complex and extensive Autodesk installs, thus the question here under the PowerShell tag.

18
0 + 0
cn flag
Greg Askew
`I have a customer whose outsourced IT uses only Domain Admins for doing workstation installs`. That's the actual problem. If someone is installing a workstation, they don't need the codes to the White House nuclear briefcase. And yes, if you are using an account that has not been granted permission to perform its task, there will be problems.
0
Reply
gp flag
Gordon
@greg-askew Thanks for that verification. I would love to find some Microsoft documentation on this, to send to customers with bad habits, but so far I can't even refund the documentation I found years ago. The key though is that it seems like Microsoft does the blocking. When looking at GPO and permissions, the user account should be able to do the things that are failing. And CAN manually. It seems like Microsoft limits PowerShell functionality for Domain Admins how are logged in, but NOT for Domain Admins who are removing, and not for Local Admins. But I can't seem to find proof.
0
Reply
cn flag
Greg Askew
Probably easier to tell them the requirements for the account you need.
0
Reply
gp flag
Gordon
@greg-askew Unfortunately, that's not really an option. They are pretty close to incompetent, and I don't think I am going to change that. Especially if I can't point them at something official from Microsoft explaining things. They are the "IT Consultants", and aren't really open to criticism, or even well intentioned advice.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.