Windows stores information about user accounts and security groups in a security database. Where the security database resides depends on whether your computer is part of a workgroup or a domain.
A workgroup setup (or a standalone computer) uses only local user accounts and local groups—the type described in this chapter. The security database on each computer stores the local user accounts and local groups that are specific to that computer. Local user accounts allow users to log on only to the computer where you create the local account. Likewise, a local account allows users to access resources only on that same computer. (This doesn't mean that you can't share your resources with other network users, even if you're not part of a domain. For details, see Chapter 18, "Sharing and Managing Network Resources")
The alternative is to set up the network as a domain . A Windows domain is a network that has at least one machine running Windows Server as a domain controller. A domain controller is a computer that maintains the security database, including user accounts and groups, for the domain. With a domain user account, you can log on to any computer in the domain (subject to your privileges set at the domain level and on individual computers), and you can gain access to permitted resources anywhere on the network
In general, if your computer is part of a Windows domain, you shouldn't need to concern yourself with local user accounts . Instead, all user accounts should be managed at the domain controller. But you might want to add certain domain user accounts or groups to your local groups . By default, the Domain Admins group is a member of the local Administrators group, and Domain Users is a member of the local Users group; members of those domain groups thereby assume the rights and permissions afforded to the local groups to which they belong .
Was this article helpful?