Windows stores information about user accounts and security groups in a security database Where the security database resides depends on whether your computer is part of a workgroup or a domain.
A workgroup setup (or a standalone computer) uses only local user accounts and local groups— The security database on each computer stores the local user accounts and local groups that are specific to that computer Local user accounts allow users to log on only to the computer where you create the local account Likewise, a local account allows users to access resources only on that same computer (This doesn’t mean that you can’t share your resources with other network users, even if you’re not part of a domain) With such a setup, you avoid the initial expense of purchasing and configuring Microsoft Windows Server 2003—but because you must manage user accounts on each individual computer, this process becomes unwieldy with more than five or ten computers.
The alternative is to set up the network as a domain A Windows domain is a network that has at least one machine running Windows Server 2003, Windows 2000 Server, or Windows NT Server as a domain controller A domain controller is a computer that maintains the security database, including user accounts and groups, for the domain With a domain user account, you can log on to any computer in the domain (subject to your privileges set at the domain level and on individual computers), and you can gain access to permitted resources anywhere on the network.
In general, if your computer is part of a Windows domain, you shouldn’t need to concern yourself with local user accounts Instead, all user accounts should be managed at the domain controller But you might want to add certain domain user accounts or groups to your local groups By default, the Domain Admins group is a member of the local Administrators group, and Domain Users is a member of the local Users group; members of those domain groups thereby assume the rights and permissions afforded to the local groups to which they belong.
Domain-based accounts and groups are also known as global accounts and global groups.
