5-10. Empty as Many of the Built-in Groups as Possible

Solution overview

Type of solution	Guidance
Features and tools	Protected built-in groups, adminSDHolder
Solution summary	Remove the members of built-in, protected groups.
Benefits	Gain more granular, managed control over Active Directory delegation, and prevent the user accounts that belong to protected groups from being exempted from the normal inheritance of Active Directory permissions.

Introduction

To support rapid deployment of Active Directory, Windows provides several default administrative groups with preconfigured permissions and rights in the domain. Most of those groups—including Account Operators, Backup Operators, Print Operators, and Server Operators—can be found in the Built-in OU. Wherever possible, you should delegate those permissions and rights to custom groups and empty out the membership of the built-in groups. Doing so will make your delegation more manageable and help you avoid problems associated with membership in protected groups.