Administrator Reports

10 Reports
About Administrator Reports

Administrator Reports provide critical visibility into privileged accounts and administrative access across your Active Directory environment. Monitor membership in key admin groups like Domain Admins, Enterprise Admins, Schema Admins, and the built-in Administrators group to maintain security and compliance.

Privileged Access

Track high-privilege administrator accounts

Group Membership

Monitor direct and nested admin assignments

Security Audit

Ensure principle of least privilege

Example: Administrator Reports in AD Reports

Administrator Reports
Quick Navigation

Available Reports

All Admins

Comprehensive report showing all users with administrative privileges across all major admin groups including Administrators, Domain Admins, Enterprise Admins, and Schema Admins (primary, direct, and nested members).

Use Cases
  • Complete administrative access inventory
  • Security audit of privileged accounts
  • Compliance reporting
  • Emergency admin contact list
Key Information
  • All users with admin rights
  • Admin group memberships
  • Primary, direct, and nested membership
  • Account status and last logon
  • Privilege level details
Critical Security: Review regularly! This shows ALL accounts with elevated privileges. Minimize admin membership.
Admins (Direct Members Only)

Lists users who are primary or direct members of admin groups, excluding nested memberships. Useful for identifying explicitly assigned administrators.

Use Cases
  • Audit explicit admin assignments
  • Identify directly added members
  • Verify intentional admin access
  • Distinguish from nested inheritance
Key Information
  • Primary and direct members only
  • Excludes nested group inheritance
  • Explicit admin assignments
  • Account details
  • Date added to group
Best Practice: Compare with "All Admins" to identify nested memberships that may be unintended.
Administrators (Built-in Group, Direct Members)

Shows primary and direct members of the built-in Administrators group - the most powerful local admin group on domain controllers.

Use Cases
  • Audit local administrator access
  • DC administrative access review
  • Built-in group membership tracking
  • Server administrator identification
Key Information
  • Built-in Administrators members
  • Local admin privileges
  • DC control capability
  • Full system access rights
  • Primary and direct membership
Critical Access: Members have full control over domain controllers. Severely restrict membership!
Domain Admins (Direct Members)

Lists direct members of Domain Admins - full administrative control over the domain including all computers and users.

Use Cases
  • Audit domain-level admin access
  • Verify domain administrator list
  • Compliance with admin policies
  • Track domain-wide privileges
Key Information
  • Domain Admins direct members
  • Full domain control rights
  • All DC administrative access
  • Member of Administrators on all domain computers
  • Assignment dates
High Risk: Domain Admins have complete control. Minimize membership - typically 2-5 accounts maximum.
Enterprise Admins (Direct Members)

Shows direct members of Enterprise Admins - forest-wide administrative control across all domains in the forest.

Use Cases
  • Audit forest-level admin access
  • Multi-domain administrator tracking
  • Enterprise-wide privilege review
  • Forest root domain security
Key Information
  • Enterprise Admins members
  • Forest-wide control
  • All domain administrative access
  • Schema and configuration partition access
  • Ultimate privilege level
Highest Risk: Enterprise Admins control the entire forest. Keep to absolute minimum - often 1-2 accounts only!
Schema Admins (Direct Members)

Lists direct members of Schema Admins - ability to modify the Active Directory schema affecting the entire forest.

Use Cases
  • Audit schema modification rights
  • Track schema administrator access
  • Application deployment verification
  • Schema extension security
Key Information
  • Schema Admins members
  • Schema modification capability
  • Forest-wide schema changes
  • Permanent structural changes
  • Application schema extensions
Special Purpose: Schema changes are rarely needed. This group should usually be empty except during schema updates.
With 'Domain Admins' as Primary Group

Shows users with Domain Admins set as their primary group - unusual configuration requiring review.

Use Cases
  • Identify unusual configurations
  • POSIX/UNIX compatibility review
  • Primary group audit
  • Configuration standard compliance
Key Information
  • Primary group: Domain Admins
  • Non-standard configuration
  • POSIX primary group ID
  • File ownership implications
  • Security considerations
Unusual: Most accounts should have "Domain Users" as primary. Review for necessity.
With 'Enterprise Admins' as Primary Group

Lists users with Enterprise Admins as primary group - extremely rare and likely misconfigured.

Use Cases
  • Identify configuration issues
  • Audit primary group settings
  • Detect accidental assignments
  • Security misconfiguration review
Key Information
  • Primary group: Enterprise Admins
  • Highly unusual configuration
  • Potential misconfiguration
  • Security implications
  • Correction recommendations
Review Required: This is rarely intentional. Verify necessity and consider changing to Domain Users.
With 'Schema Admins' as Primary Group

Shows users with Schema Admins as primary group - almost always a configuration error.

Use Cases
  • Identify misconfigured accounts
  • Primary group error detection
  • Configuration cleanup
  • Standard compliance verification
Key Information
  • Primary group: Schema Admins
  • Configuration error likely
  • Should be corrected
  • Change to Domain Users
  • Impact assessment
Configuration Error: This is almost never correct. Change primary group to Domain Users.
With Any Admin Group as Primary Group

Comprehensive report showing all users with any administrative group set as their primary group.

Use Cases
  • Complete primary group audit
  • Identify all non-standard configs
  • Bulk configuration review
  • Cleanup and remediation
Key Information
  • All admin groups as primary
  • Comprehensive view
  • Configuration anomalies
  • Accounts needing correction
  • Remediation priorities
Pro Tip: Use this for bulk review. Most should be changed to Domain Users as primary group.
Related Reports

Explore other user report categories:

General User Reports Basic user info and profiles
Group Membership Reports User group assignments
Account Status Reports Enabled, disabled, locked accounts
Back to Report Library Back to Top