Data Domain: Why the Default Domain Admins Group Cannot Be Deleted

• Data Domain is joined to Active Directory and the Domain Admins are listed as an administrative group.
• When attempting to remove or delete the entry, the option to delete the group is unavailable.
  • The DD is preventing removal of the Domain Admins group.

This behavior is expected.

• When a Data Domain system is joined to an Active Directory domain, the Domain Admins group is automatically assigned to Admin Group 1.
• Data Domain uses Domain Admins as the default group because it is the only Active Directory group that can be expected to exist in all Windows environments.
• The restriction is not tied specifically to the Domain Admins group itself.
  • Admin Group 1 is a required system-defined administrative group entry that cannot be deleted.
  • Data Domain requires at least one designated administrative group to remain configured for authentication and management access.

If members of the Domain Admins group should not have administrative access to the Data Domain system, replace the Domain Admins entry with a different Active Directory group instead of attempting to delete it.
Data Domain supports:

• Up to two Active Directory administrative groups
• Up to two Active Directory user groups

Admin Group 1 can be edited but cannot be deleted.
Using the GUI, navigate to:

1. Administration > Access > Authentication > Active Directory / Kerberos Authentication
2. Locate the existing Domain Admins entry.
3. Select the group and choose Edit (pencil icon).
4. Browse for the desired Active Directory group using the format:
   domain\group
5. Save the changes.

Example:

Existing group: Domain Admins
Replacement group: Corp\Backup_Admins

After the change is saved, Corp\Backup_Admins becomes the assigned Admin Group 1, and Domain Admins no longer provides administrative access to the Data Domain system.
Using the CLI
To replace the configured administrative group, use:

cifs option set "dd admin group1" "domain\group"

Example:

cifs option set "dd admin group1" "Corp\Backup_Admins"

The configured group replaces the existing Admin Group 1 entry.

Active Directory group membership determines who can authenticate to the Data Domain system, while the role assigned within Data Domain determines the level of access and the administrative functions that users can perform. Therefore, replacing Domain Admins with a dedicated administration group is a common best practice that allows organizations to align Data Domain access with their internal security requirements.