Active Directory security groups

This article discusses default Active Directory security groups, group scope, and group functions.

What is a security group in Active Directory?

Active Directory has two forms of common security principals: user accounts and computer accounts. These accounts represent a physical entity that's either a person or a computer. A user account also can be used as a dedicated service account for some applications.

Security groups are a way to collect user accounts, computer accounts, and other groups into manageable units.

In the Windows Server operating system (OS), several built-in accounts and security groups are preconfigured with the appropriate rights and permissions to perform specific tasks. In Active Directory, administrative responsibilities are separated into two types of administrators:

• Service administrators: Responsible for maintaining and delivering Active Directory Domain Services (AD DS), including managing domain controllers and configuring AD DS
• Data administrators: Responsible for maintaining the data that's stored in AD DS and on domain member servers and workstations

How Active Directory security groups work

You can use groups to collect user accounts, computer accounts, and other groups into manageable units. Working with groups instead of with individual users helps you simplify network maintenance and administration.

Active Directory has two types of groups:

• Security groups: Used to assign permissions to shared resources.
• Distribution groups: Used to create email distribution lists.

Security groups

Security groups can provide an efficient way to assign access to resources on your network. By using security groups, you can:

• Assign user rights to security groups in Active Directory.

  You can assign user rights to a security group to determine what members of that group can do within the scope of a domain or forest. User rights are automatically assigned to some security groups when Active Directory is installed to help administrators define a person's administrative role in the domain.

  For example, a user who you add to the Backup Operators group in Active Directory can back up and restore files and directories that are located on each domain controller in the domain. The user can complete these actions because, by default, the user rights Backup files and directories and Restore files and directories are automatically assigned to the Backup Operators group. Therefore, members of this group inherit the user rights that are assigned to that group.

  You can use Group Policy to assign user rights to security groups to delegate specific tasks. For more information about using Group Policy, see User Rights Assignment.

• Assign permissions to security groups for resources.

  Permissions are different from user rights. Permissions are assigned to a security group for a shared resource. Permissions determine who can access the resource and the level of access, such as Full control or Read. Some permissions that are set on domain objects are automatically assigned to allow various levels of access to default security groups like the Account Operators group or the Domain Admins group.

  Security groups are listed in discretionary access control lists (DACLs) that define permissions on resources and objects. When administrators assign permissions for resources like file shares or printers, they should assign those permissions to a security group instead of to individual users. The permissions are assigned once to the group instead of multiple times to each individual user. Each account that's added to a group receives the rights that are assigned to that group in Active Directory. The user receives permissions that are defined for that group.

You can use a security group as an email entity. Sending an email message to a security group sends the message to all the members of the group.

Distribution groups

You can use distribution groups only to send email to collections of users by using an email application like Exchange Server. Distribution groups aren't security enabled, so you can't include them in DACLs.

Group scope

Each group has a scope that identifies the extent to which the group is applied in the domain tree or forest. The scope of a group defines the areas of the network where permissions can be granted for the group. Active Directory defines the following three group scopes:

• Universal
• Global
• Domain Local

The following table describes the three group scopes and how they work as security groups:

Special identity groups

A special identity group is where certain special identities are grouped together. Special identity groups don't have specific memberships that you can modify, but they can represent different users at different times depending on the circumstances. These groups include Creator Owner, Batch, and Authenticated User.

For more information, see Special identity groups.

Default security groups

Default groups like the Domain Admins group are security groups that are created automatically when you create an Active Directory domain. These predefined groups can help you control access to shared resources and delegate specific domain-wide administrative roles.

Many default groups are automatically assigned a set of user rights. These rights authorize members of the group to perform specific actions in a domain, like signing in to a local system or backing up files and folders. For example, a member of the Backup Operators group can perform backup operations for all domain controllers in the domain.

When you add a user to a group, the user receives all the user rights that are assigned to the group, including all the permissions that are assigned to the group for any shared resources.

Default groups are located in the Builtin container or the Users container in the Active Directory Users and Computers tool. The Builtin container includes groups that are defined with the Domain Local scope. The Users container includes groups that are defined with Global scope and groups that are defined with Domain Local scope. You can move groups that are located in these containers to other groups or organizational units within the domain. But you can't move them to other domains.

Some of the administrative groups that are listed in this article and all members of these groups are protected by a background process that periodically checks for and applies a specific security descriptor. This descriptor is a data structure that contains security information that's associated with a protected object. This process ensures that any successful unauthorized attempt to modify the security descriptor on one of the administrative accounts or groups is overwritten with the protected settings.

The security descriptor is present on the AdminSDHolder object. If you want to modify the permissions on one of the service administrator groups or on any of its member accounts, you must modify the security descriptor on the AdminSDHolder object so that it's applied consistently. Be careful when you make these modifications because you're also changing the default settings that are applied to all your protected administrative accounts.

Each default security group has a unique identifier that consists of multiple components. Among those components is a relative ID (RID), which is unique within the group's domain.

Default Active Directory security groups

The following links lead to descriptions of the default groups that are located in the Builtin container or the Users container in Active Directory.

• Access Control Assistance Operators
• Account Operators
• Administrators
• Allowed RODC Password Replication
• Backup Operators
• Certificate Service DCOM Access
• Cert Publishers
• Cloneable Domain Controllers
• Cryptographic Operators
• Denied RODC Password Replication
• Device Owners
• DHCP Administrators
• DHCP Users
• Distributed COM Users
• DnsUpdateProxy
• DnsAdmins
• Domain Admins
• Domain Computers
• Domain Controllers
• Domain Guests
• Domain Users
• Enterprise Admins
• Enterprise Key Admins
• Enterprise Read-only Domain Controllers
• Event Log Readers
• Group Policy Creator Owners
• Guests
• Hyper-V Administrators
• IIS_IUSRS
• Incoming Forest Trust Builders
• Key Admins
• Network Configuration Operators
• Performance Log Users
• Performance Monitor Users
• Pre–Windows 2000 Compatible Access
• Print Operators
• Protected Users
• RAS and IAS Servers
• RDS Endpoint Servers
• RDS Management Servers
• RDS Remote Access Servers
• Read-only Domain Controllers
• Remote Desktop Users
• Remote Management Users
• Replicator
• Schema Admins
• Server Operators
• Storage Replica Administrators
• System Managed Accounts
• Terminal Server License Servers
• Users
• Windows Authorization Access
• WinRMRemoteWMIUsers__

Access Control Assistance Operators

Members of this group can remotely query authorization attributes and permissions for resources on the computer. This group can't be renamed, deleted, or removed.

Account Operators

The Account Operators group grants limited account creation privileges to a user. Members of this group can create and modify most types of accounts, including accounts for users, Local groups, and Global groups. Group members can sign in locally to domain controllers.

Members of the Account Operators group can't modify user rights. Also, members of this group can't manage the following accounts and groups:

• Administrator user account
• User accounts of administrators
• Administrators
• Server Operators
• Account Operators
• Backup Operators
• Print Operators

This group can't be renamed, deleted, or removed.

Administrators

Members of the Administrators group have complete and unrestricted access to the computer. If the computer is promoted to a domain controller, members of the Administrators group have unrestricted access to the domain.

Allowed RODC Password Replication

The purpose of this security group is to manage a read-only domain controller (RODC) password replication policy. This group has no members by default. As a result, new RODCs don't cache user credentials. The Denied RODC Password Replication group contains various high-privilege accounts and security groups. The Denied RODC Password Replication group supersedes the Allowed RODC Password Replication group. This group can't be renamed, deleted, or removed.

Backup Operators

Members of the Backup Operators group can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can sign in to and shut down the computer. This group can't be renamed, deleted, or removed. By default, this built-in group has no members, and it can perform backup and restore operations on domain controllers. Members of the following groups can modify Backup Operators group membership: default service administrators, Domain Admins in the domain, and Enterprise Admins. Members of the Backup Operators group can't modify the membership of any administrative groups. Although members of this group can't change server settings or modify the configuration of the directory, they do have the permissions needed to replace files (including OS files) on domain controllers. Because members of this group can replace files on domain controllers, they're considered to be service administrators.

Certificate Service DCOM Access

Members of this group can connect to certification authorities in the enterprise. This group can't be renamed, deleted, or removed.

Cert Publishers

Members of the Cert Publishers group are authorized to publish certificates for user objects in Active Directory. This group can't be renamed, deleted, or removed.

Cloneable Domain Controllers

Members of the Cloneable Domain Controllers group that are domain controllers can be cloned. In Windows Server 2012 R2 and Windows Server 2012, you can deploy domain controllers by copying an existing virtual domain controller. In a virtual environment, you can't repeatedly deploy a server image that's prepared by using the Sysprep.exe tool. Promoting the server to a domain controller, and then completing more configuration requirements for deploying each domain controller (including adding the virtual domain controller to this security group), is also not allowed. This group can't be renamed, deleted, or removed.

For more information, see Safely virtualizing Active Directory Domain Services (AD DS).

Cryptographic Operators

Members of this group are authorized to perform cryptographic operations. This security group configures Windows Firewall for IPsec in Common Criteria mode. This group can't be renamed, deleted, or removed.

Denied RODC Password Replication

Passwords of members of the Denied RODC Password Replication group can't be replicated to any RODC.

The purpose of this security group is to manage a RODC password replication policy. This group contains various high-privilege accounts and security groups. The Denied RODC Password Replication group supersedes the Allowed RODC Password Replication group.

Device Owners

When the Device Owners group has no members, we recommend that you don't change the default configuration for this security group. Changing the default configuration might hinder future scenarios that rely on this group. The Device Owners group currently isn't used in Windows.

DHCP Administrators

Members of the DHCP Administrators group can create, delete, and manage various areas of the server's scope. Group rights include the ability to back up and restore the Dynamic Host Configuration Protocol (DHCP) database. Even though this group has administrative rights, it isn't part of the Administrators group because this role is limited to DHCP services.

DHCP Users

Members of the DHCP Users group can see which scopes are active or inactive, including which IP addresses are assigned. Group members can also view connectivity issues if the DHCP server isn't configured correctly. This group is limited to read-only access to the DHCP server.

Distributed COM Users

Members of the Distributed COM Users group can launch, activate, and use Distributed Component Object Model (DCOM) objects on the computer. Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. When you use DCOM objects, you can distribute your applications across locations that make the most sense to you and to the applications. This group appears as an SID until the domain controller is made the primary domain controller and it holds the operations master role, which is also called the flexible single master operations (FSMO) role. This group can't be renamed, deleted, or removed.

DnsUpdateProxy

Members of the DnsUpdateProxy group are Domain Name System (DNS) clients. They're permitted to perform dynamic updates on behalf of other clients, such as DHCP servers. A DNS server can develop stale resource records when a DHCP server is configured to dynamically register host (A) and pointer (PTR) resource records on behalf of DHCP clients by using dynamic update. Adding clients to this security group mitigates this scenario.

To protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account. You must also configure DHCP servers to perform DNS dynamic updates by using the username, password, and domain of this account. Multiple DHCP servers can use the credentials of one dedicated user account. This group exists only if the DNS server role is or was once installed on a domain controller in the domain.

For more information, see DNS record ownership and the DnsUpdateProxy group.

DnsAdmins

Members of the DnsAdmins group have access to network DNS information. By default, members of this group are assigned the following allow permissions: Read, Write, Create All Child objects, Delete Child objects, and Special Permissions. This group exists only if the DNS server role is or was once installed on a domain controller in the domain.

For more information about security and DNS, see DNSSEC in Windows Server 2012.

Domain Admins

Members of the Domain Admins security group are authorized to administer the domain. By default, the Domain Admins group is a member of the Administrators group on all computers that join a domain, including the domain controllers. The Domain Admins group is the default owner of any object that's created in Active Directory for the domain by any member of the group. If members of the group create other objects, such as files, the default owner is the Administrators group.

The Domain Admins group controls access to all domain controllers in a domain, and it can modify the membership of all administrative accounts in the domain. Members of the service administrator groups in its domain (Administrators and Domain Admins) and members of the Enterprise Admins group can modify Domain Admins membership. This group is considered to be a service administrator account because its members have full access to the domain controllers in a domain.

Domain Computers

This group can include all computers and servers that join the domain, excluding domain controllers. By default, any computer account that's created becomes a member of this group automatically.

Domain Controllers

The Domain Controllers group can include all domain controllers in the domain. New domain controllers are automatically added to this group.

Domain Guests

The Domain Guests group includes the domain's built-in Guest account. When members of this group sign in as local guests on a domain-joined computer, a domain profile is created on the local computer.

Domain Users

The Domain Users group includes all user accounts in a domain. When you create a user account in a domain, it's added to this group by default.

You can use this group to represent all users in the domain. For example, if you want all domain users to have access to a printer, you can assign permissions for the printer to this group. Or you can add the Domain Users group to a Local group on the print server that has permissions for the printer.

Enterprise Admins

The Enterprise Admins group exists only in the root domain of an Active Directory forest of domains. The group is a Universal group if the domain is in native mode. The group is a Global group if the domain is in mixed mode. Members of this group are authorized to make forest-wide changes in Active Directory, like adding child domains.

By default, the only member of the group is the Administrator account for the forest root domain. This group is automatically added to the Administrators group in every domain in the forest, and it provides complete access to configuring all domain controllers. Members in this group can modify the membership of all administrative groups. Members of the default service administrator groups in the root domain can modify Enterprise Admins membership. This group is considered to be a service administrator account.

Enterprise Key Admins

Members of this group can perform administrative actions on key objects within the forest.

Enterprise Read-only Domain Controllers

Members of this group are RODCs in the enterprise. Except for account passwords, an RODC holds all the Active Directory objects and attributes that a writable domain controller holds. However, changes can't be made to the database that's stored on the RODC. Changes must be made on a writable domain controller and then replicated to the RODC.

RODCs address some of the issues that are commonly found in branch offices. These locations might not have a domain controller, or they might have a writable domain controller but not the physical security, network bandwidth, or local expertise to support it.

For more information, see What Is an RODC?.

Event Log Readers

Members of this group can read event logs from local computers. The group is created when the server is promoted to a domain controller. This group can't be renamed, deleted, or removed.

Group Policy Creator Owners

This group is authorized to create, edit, and delete Group Policy Objects in the domain. By default, the only member of the group is Administrator.

For information about other features you can use with this security group, see Group Policy overview.

Guests

Members of the Guests and Users group have similar access by default. The difference is that the Guest account has further restrictions. By default, the only member of the Guests group is the Guest account. The Guests group makes it possible for occasional or one-time users to sign in with limited privileges to a computer's built-in Guest account.

When a member of the Guests group signs out, the entire profile is deleted. The profile deletion includes everything that's stored in the %userprofile% directory, including the user's registry hive information, custom desktop icons, and other user-specific settings. This fact implies that a guest must use a temporary profile to sign in to the system. This security group interacts with the following Group Policy setting: Do not log users on with temporary profiles. To access this setting, open the Group Policy Management editor, and then go to Computer Configuration > Administrative Templates > System > User Profiles.

This group can't be renamed, deleted, or removed.

Hyper-V Administrators

Members of the Hyper-V Administrators group have complete and unrestricted access to all the features in Hyper-V. Adding members to this group helps reduce the number of members required in the Administrators group and further separates access. This group can't be renamed, deleted, or removed.

IIS_IUSRS

IIS_IUSRS is a built-in group that's used by Internet Information Services (IIS), beginning with IIS 7. The OS ensures that each built-in account and group have a unique SID. IIS 7 replaces the IUSR_MachineName account and the IIS_WPG group with the IIS_IUSRS group to ensure that the actual names that the new account and group use are never localized. For example, regardless of the language of the Windows OS that you install, the IIS account name is IUSR, and the group name is IIS_IUSRS.

For more information, see Understand built-in user and group accounts in IIS 7.

Incoming Forest Trust Builders

Members of the Incoming Forest Trust Builders group can create incoming, one-way trusts to a forest. Active Directory provides security across multiple domains or forests through domain and forest trust relationships. Before authentication can occur across trusts, Windows must determine whether the domain requested is by a user, computer, or service that has a trust relationship with the sign-in domain of the requesting account.

To make this determination, the Windows security system computes a trust path between the domain controller for the server that receives the request and a domain controller in the domain of the requesting account. A secured channel extends to other Active Directory domains through interdomain trust relationships. This secured channel is used to obtain and verify security information, including SIDs for users and groups.

This group appears as an SID until the domain controller is made the primary domain controller and it holds the operations master (FSMO) role. This group can't be renamed, deleted, or removed.

For more information, see How Domain and Forest Trusts Work.

Key Admins

Members of this group can perform administrative actions on key objects within the domain.

Network Configuration Operators

Members of the Network Configuration Operators group have the following administrative privileges to manage configuration of networking features:

• Modify the Transmission Control Protocol/Internet Protocol (TCP/IP) properties for a local area network (LAN) connection, which includes the IP address, the subnet mask, the default gateway, and the name servers
• Rename the LAN connections or remote access connections that are available to all the users
• Enable or disable a LAN connection
• Modify the properties of all remote access connections of users
• Delete all the remote access connections of users
• Rename all the remote access connections of users
• Issue ipconfig, ipconfig /release, and ipconfig /renew commands
• Enter the PIN unblock key (PUK) for mobile broadband devices that support a SIM card

This group appears as an SID until the domain controller is made the primary domain controller and it holds the operations master (FSMO) role. This group can't be renamed, deleted, or removed.

Performance Log Users

Members of the Performance Log Users group can manage performance counters, logs, and alerts locally on the server and from remote clients without being a member of the Administrators group. Specifically, members of this security group:

• Can use all the features that are available to the Performance Monitor Users group.
• Can't use the Windows Kernel Trace event provider in Data Collector Sets.

For members of the Performance Log Users group to initiate data logging or modify Data Collector Sets, the group must first be assigned the Log on as a batch job user right. To assign this user right, use the Local Security Policy snap-in in Microsoft Management Console (MMC).

This group appears as an SID until the domain controller is made the primary domain controller and it holds the operations master (FSMO) role. This account can't be renamed, deleted, or moved.

Performance Monitor Users

Members of this group can monitor performance counters on domain controllers in the domain, locally and from remote clients, without being a member of the Administrators or Performance Log Users groups. The Windows Performance Monitor is an MMC snap-in that provides tools for analyzing system performance. From a single console, you can monitor application and hardware performance, customize what data you want to collect in logs, define thresholds for alerts and automatic actions, generate reports, and view past performance data in various ways.

Specifically, members of this security group:

• Can use all the features that are available to the Users group.
• Can view real-time performance data in Performance Monitor.
• Can change the Performance Monitor display properties while viewing data.
• Can't create or modify Data Collector Sets.

This group appears as an SID until the domain controller is made the primary domain controller and it holds the operations master (FSMO) role. This group can't be renamed, deleted, or removed.

Pre–Windows 2000 Compatible Access

Members of the Pre–Windows 2000 Compatible Access group have Read access for all users and groups in the domain. This group is provided for backward compatibility for computers that run Windows NT 4.0 and earlier. By default, the special identity group Everyone is a member of this group. Add users to this group only if they run Windows NT 4.0 or earlier.

This group can't be renamed, deleted, or removed.

Print Operators

Members of this group can manage, create, share, and delete printers that are connected to domain controllers in the domain. They also can manage Active Directory printer objects in the domain. Members of this group can locally sign in to and shut down domain controllers in the domain.

This group has no default members. Because members of this group can load and unload device drivers on all domain controllers in the domain, add users with caution. This group can't be renamed, deleted, or removed.

For more information, see Assign delegated print administrator and printer permission settings in Windows Server 2012.

Protected Users

Members of the Protected Users group have extra protection against the compromise of credentials during authentication processes.

This security group is designed as part of a strategy to effectively protect and manage credentials within the enterprise. Members of this group automatically have nonconfigurable protection applied to their accounts. Membership in the Protected Users group is meant to be restrictive and proactively secure by default. The only way you can modify the protection for an account is to remove the account from the security group.

This domain-related Global group triggers nonconfigurable protection on devices and host computers, starting with Windows Server 2012 R2 and Windows 8.1. It also triggers nonconfigurable protection on domain controllers in domains that have a primary domain controller that runs Windows Server 2012 R2 or later. This protection greatly reduces the memory footprint of credentials when users sign in to computers on the network from a noncompromised computer.

Depending on the account's domain functional level, members of the Protected Users group are further protected due to behavior changes in the authentication methods that are supported in Windows:

• Members of the Protected Users group can't authenticate by using the following Security Support Providers (SSPs): New Technology LAN Manager (NTLM), Digest Authentication, or Credential Security Support Provider (CredSSP). Passwords aren't cached on a device running Windows 10 or Windows 8.1. The device fails to authenticate to a domain when the account is a member of the Protected Users group.
• The Kerberos protocol doesn't use the weaker Data Encryption Standard (DES) or Rivest Cipher 4 (RC4) encryption types in the preauthentication process. The domain must be configured to support at least the Advanced Encryption Standard (AES) cipher suite.
• The user's account can't be delegated with Kerberos constrained or unconstrained delegation. If the user is a member of the Protected Users group, earlier connections to other systems might fail.
• You can change the default Kerberos ticket-granting tickets (TGTs) lifetime setting of four hours by using authentication policies and silos in the Active Directory Administrative Center. In the default setting, the user must authenticate after four hours pass.

This group was introduced in Windows Server 2012 R2. For more information about how this group works, see Protected Users security group.

RAS and IAS Servers

Computers that are members of the RAS and IAS Servers group, when properly configured, can use remote access services. By default, this group has no members. Computers that run the Routing and Remote Access Service (RRAS) and remote access services, such as Internet Authentication Service (IAS) and Network Policy Servers, are added to the group automatically. Members of this group have access to certain properties of user objects, such as Read Account Restrictions, Read Logon Information, and Read Remote Access Information.

RDS Endpoint Servers

Servers that are members of the RDS Endpoint Servers group can run virtual machines and host sessions where user programs of the RemoteApp feature and personal virtual desktops run. You must populate this group on servers that run Remote Desktop Connection Broker (RD Connection Broker). Session Host servers and Remote Desktop Virtualization Host (RD Virtualization Host) servers used in the deployment must be in this group. This group can't be renamed, deleted, or removed.

For information about Remote Desktop Services (RDS), see Remote Desktop Services overview in Windows Server.

RDS Management Servers

You can use servers that are members of the RDS Management Servers group to complete routine administrative actions on servers that run RDS. You must populate this group on all servers in an RDS deployment. The servers that run the RDS Central Management service must be included in this group. This group can't be renamed, deleted, or removed.

RDS Remote Access Servers

Servers in the RDS Remote Access Servers group provide users with access to the RemoteApp feature's programs and personal virtual desktops. In internet-facing deployments, these servers typically are deployed in an edge network. You must populate this group on servers that run RD Connection Broker. Remote Desktop Gateway (RD Gateway) servers and Remote Desktop Web Access (RD Web Access) servers that are used in the deployment must be in this group. This group can't be renamed, deleted, or removed.

For more information, see Remote Desktop Services overview in Windows Server.

Read-only Domain Controllers

This group is composed of the RODCs in the domain. An RODC makes it possible for organizations to easily deploy a domain controller in scenarios in which physical security can't be guaranteed. An example scenario is a branch office location or local storage of all domain passwords that's considered to be a primary threat, like in an extranet or application-facing role.

Because you can delegate administration of an RODC to a domain user or security group, an RODC is well suited for a site that shouldn't have a user who's a member of the Domain Admins group. An RODC has the following functionality:

• A read-only AD DS database
• Unidirectional replication
• Credential caching
• Administrator role separation
• A read-only DNS

For more information, see Understanding Planning and Deployment for Read-Only Domain Controllers.

Remote Desktop Users

You can use the Remote Desktop Users group on a Remote Desktop Session Host (RD Session Host) server to grant users and groups permissions to remotely connect to an RD Session Host server. This group can't be renamed, deleted, or removed. The group appears as an SID until the domain controller is made the primary domain controller and it holds the operations master (FSMO) role.

Remote Management Users

Members of the Remote Management Users group can access Windows Management Instrumentation (WMI) resources over management protocols like Web Services for Management (WS-Management) via the Windows Remote Management service. Access to WMI resources applies only to WMI namespaces that grant access to the user.

Use the Remote Management Users group to allow users to manage servers through the Server Manager console. Use the WinRMRemoteWMIUsers__ group to allow users to remotely run Windows PowerShell commands.

This group can't be renamed, deleted, or removed.

For more information, see About WMI and What's new in MI?.

Replicator

Computers that are members of the Replicator group support file replication in a domain. Windows Server uses File Replication Service (FRS) to replicate system policies and sign-in scripts that are stored in the System Volume folder (sysvol folder). Each domain controller keeps a copy of the sysvol folder for network clients to access. FRS can also replicate data for the Distributed File System (DFS) and sync the content of each member in a replica set as defined by the DFS. FRS can copy and maintain shared files and folders on multiple servers simultaneously. When changes occur, content is synced immediately within sites and on a schedule between sites.

For more information, see the following resources:

• File Replication Service (FRS) is deprecated in Windows Server 2008 R2 (Windows)
• DFS namespaces and DFS Replication overview

This group can't be renamed, deleted, or removed.

Schema Admins

Members of the Schema Admins group can modify the Active Directory schema. This group exists only in the root domain of an Active Directory forest of domains. This group is a Universal group if the domain is in native mode. This group is a Global group if the domain is in mixed mode.

By default, the only member of the group is the Administrator account for the forest root domain. This group has full administrative access to the schema.

Any of the service administrator groups in the root domain can modify the membership of this group. This group is considered to be a service administrator account because its members can modify the schema, which governs the structure and content of the entire directory.

For more information, see What is the Active Directory schema?

Server Operators

Members of the Server Operators group can administer domain controllers. This group exists only on domain controllers. By default, this group has no members and can't be renamed, deleted, or removed. Members of the Server Operators group can take the following actions:

• Sign in to a server interactively
• Create and delete network shared resources
• Stop and start services
• Back up and restore files
• Format the hard disk drive of the device
• Shut down the device

By default, this built-in group has no members. This group has access to server configuration options on domain controllers. Its membership is controlled through the service administrator groups Administrators and Domain Admins in the domain, and by the Enterprise Admins group in the forest root domain. Members in this group can't change any administrative group memberships. This group is considered to be a service administrator account because its members have physical access to domain controllers. Members of this group can perform maintenance tasks like backup and restore, and they can change binaries that are installed on the domain controllers. For the group's default user rights, see the following table.

Storage Replica Administrators

Members of the Storage Replica Administrators group have complete and unrestricted access to all features of the Storage Replica tool.

System Managed Accounts

Membership of the System Managed Accounts group is system managed. This group includes the Default System Managed Account (DSMA), which facilitates system functions.

Terminal Server License Servers

Members of the Terminal Server License Servers group can update user accounts in Active Directory with information about license issuance. The group is used to track and report Terminal Server Per User Client Access License (TS Per User CAL) usage. A TS Per User CAL gives one user the right to access an instance of Terminal Server from an unlimited number of client computers or devices. This group appears as an SID until the domain controller is made the primary domain controller and it holds the operations master (FSMO) role. This group can't be renamed, deleted, or removed.

For more information about this security group, see Terminal Services License Server security group configuration.

Users

Members of the Users group are prevented from making accidental or intentional system-wide changes. Members of this group can run most applications. After the initial installation of the OS, the only member is the Authenticated Users group. When a computer joins a domain, the Domain Users group is added to the Users group on the computer.

Users can do tasks like run an application, use local and network printers, shut down the computer, and lock the computer. Users can install applications that only they can use if the installation program of the application supports per-user installation. This group can't be renamed, deleted, or removed.

Windows Authorization Access

Members of this group have access to the tokenGroupsGlobalAndUniversal attribute on user objects. This access is useful, because some application features read the token-groups-global-and-universal (TGGAU) attribute on user account objects or on computer account objects in AD DS. Some Win32 functions make it easier to read the TGGAU attribute. But applications that read this attribute or that call an API that reads this attribute don't succeed if the calling security context doesn't have access to the attribute. This group makes it easier to grant read access to the attribute.

This group appears as an SID until the domain controller is made the primary domain controller and it holds the operations master (FSMO) role. This group can't be renamed, deleted, or removed.

WinRMRemoteWMIUsers__

Starting with Windows Server 2012 and Windows 8, the Advanced Security Settings user interface contains a Share tab. This tab displays the security properties of a remote file share. To view this information, you must have the following permissions and memberships:

• You must be a member of the WinRMRemoteWMIUsers__ group or the BUILTIN\Administrators group.
• You must have Read permissions to the file share.

In Windows Server 2012, the Access Denied Assistance functionality adds the Authenticated Users group to the local WinRMRemoteWMIUsers__ group. When the Access Denied Assistance functionality is enabled, all authenticated users who have Read permissions to the file share can view the file share permissions.

Related content

• Security principals
• Special identity groups
• Access control overview