Domains and Workgroups

[Previous] [Next]

Since the advent of Windows NT 3.1, people have been somewhat perplexed about the difference between a domain and a workgroup. The simplest way to discern the difference is to ask, "Where are the user accounts authenticated?" If each account is authenticated on each computer, you have a workgroup. If the accounts are authenticated at a central location, you have a domain. Servers performing centralized authentication are often referred to as domain controllers.

Here's another way of looking at it: A domain is a grouping of accounts and network resources under a single domain name and security boundary. A workgroup is a simpler grouping, intended only to help users find objects such as printers and shared folders within that smaller group. Domains are the recommended choice for all networks except small ones with few users.

In a workgroup, users might have to remember multiple passwords, one for each network resource. In a domain, passwords and permissions are simpler to maintain, since a domain has a single, centralized database of user accounts and permissions. The information in this database is replicated automatically among domain controllers. You determine which servers are domain controllers and which are simply members of the domain.

As mentioned, a domain can have one or more domain controllers. A small organization using a single local area network (LAN) might require only one domain with two domain controllers for high availability and fault tolerance (that is, the ability of the system to recover from errors without losing data). A large company with many geographical locations will require one or more domain controllers in each location to provide high availability and fault tolerance.