Manage Security - MCSA Windows Server 2012 R2: Installation and Configuration Study Guide - page 361

Built-in Domain Local Groups
System administrators use built-in domain local groups to perform administrative func-
tions on the local server. Because these have pre-assigned permissions and privileges, they
allow system administrators to assign common management functions easily. Figure 7.3
shows the default built-in groups that are available on a Windows Server 2012 R2 domain
controller.

figure 7.3 Default built-in local groups

The list of built-in local groups includes some of the following:
Account Operators These users can create and modify domain user and group accounts.
Members of this group are generally responsible for the daily administration of Active
Director y.
Administrators By default, members of the Administrators group are given full
permissions to perform any functions within the Active Directory domain and on the
local computer. This means they can access all files and resources that reside on any server
within the domain. As you can see, this is a powerful account.