RE: [Full-disclosure] Flaw in Microsoft Domain Account CachingAl
> If I take the domain admin out of my local administrators, they can't do
anything. Done.
Back when I did AD/domain support, all domain user accounts got a profile
that included a trivial script to re-add Domain Admins to the Local Admins
group. So this kind of local removal shenanigans lasted only until the user
next logged into the domain.
David Gillett