Windows 10: admins in builtin administrator group getting kicked out randomly

Good morning guys, recently I've been having issues where some of our users who were apart of the member of in the administrators built in group in active directory keep getting randomly kicked out of the group. What I've been doing is heading into the admin server and re adding the administrators to the group and then press apply after I add them do I also have to run a gpupdate? and then after a while I go back to go check they are removed in the member of in the administrator group again and I have checked in the audit logs it seems to be kicking them off but noone in my department is going in there and removing users. Another thing that has happened is our domain users are no longer administrators on there own their own devices so they cant access task manager for example without having to input administrative credentials, how can I fix this issue also when I try to make a user a domain administrator on that device I get access denied. We currently had to reboot our servers and had an ad sync not sure if either of those could cause a problem. Thanks in advanced for you help.

:)

 

builtin\administrators

If it is using that much space it may be your OWN profile.

Go to C:\Users, check the space each user is using if you profile is the same as 60GB, I would not recommend deleting it as its your profile.

That builtin\administrators is the administrator group.

 

admin rights keep disappearing!?!!

Hi guys,

I am actually having a problem at work that our IT department hasn't been able to figure out. I am supposed to be a member of the admin group. We are on a domain. The problem is that everytime I reboot the computer I loose my admin rights(no longer in the administrator group) and just become a normal user again. I have tried googling this and didn't get to many results.
I believe IT is just giving me local admin rights, not admin rights for the whole domain.

Any suggestions?

EDIT: It is on Windows XP Pro.

 

Why does CompatTelRunner.exe enumerate the builtin\Administrator's group?

Hi,

I'm aware that CompatTelRunner.exe is a legit Microsoft performance analysis tool, which sends telemetry data back to Microsoft so they can better their product. Apart from numerous complaints about performance impacts caused by this executable, I was
surprised today to find it also enumerates the built-in Administrator's group on my Windows10 workstation...! What is the process doing enumerating this (or really any) group?? I'll paste the event below:

Code:

Log Name:      Security

Source:        Microsoft-Windows-Security-Auditing

Date:          10/18/2018 3:24:52 AM

Event ID:      4799

Task Category: Security Group Management

Level:         Information

Keywords:      Audit Success

User:          N/A

Computer:      mywin10.<mydomain>.com

Description:

A security-enabled local group membership was enumerated.

Subject:

Security ID: SYSTEM

Account Name: MYWIN10$

Account Domain: <MYDOMAIN>

Logon ID: 0x3E7

Group:

Security ID: BUILTIN\Administrators

Group Name: Administrators

Group Domain: Builtin

Process Information:

Process ID: 0x1bd4

Process Name: C:\Windows\System32\CompatTelRunner.exe

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />

    <EventID>4799</EventID>

    <Version>0</Version>

    <Level>0</Level>

    <Task>13826</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8020000000000000</Keywords>

    <TimeCreated SystemTime="2018-10-18T10:24:52.478717900Z" />

    <EventRecordID>573250</EventRecordID>

    <Correlation ActivityID="{47AAF424-0322-0001-75F4-AA472203D401}" />

    <Execution ProcessID="616" ThreadID="5408" />

    <Channel>Security</Channel>

    <Computer>mywin10.<mydomain>.com</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="TargetUserName">Administrators</Data>

    <Data Name="TargetDomainName">Builtin</Data>

    <Data Name="TargetSid">S-1-5-32-544</Data>

    <Data Name="SubjectUserSid">S-1-5-18</Data>

    <Data Name="SubjectUserName">MYWIN10$</Data>

    <Data Name="SubjectDomainName">MYDOMAIN</Data>

    <Data Name="SubjectLogonId">0x3e7</Data>

    <Data Name="CallerProcessId">0x1bd4</Data>

    <Data Name="CallerProcessName">C:\Windows\System32\CompatTelRunner.exe</Data>

  </EventData>

</Event>

Why does a performance telemetry tool need to do this?