Local vs. Domain User Accounts and Groups | Running Microsoft Windows 2000 Professional

[Previous] [Next]

The predefined users and groups we've covered in this chapter are examples of local users and groups. Local user accounts allow users to log on only to the computer where you create the local account. Likewise, a local account allows users to access resources only on that same computer. (This doesn't mean that you can't share your resources with other network users, even if you're not part of a domain. To do that, however, you need to create a local user account for each person who needs access to shared resources—on each computer that contains the shared resources. With more than a handful of computers and users, this gets messy.)

The alternative is to set up the network as a domain. A Windows 2000 domain is a network that has at least one machine running Windows 2000 Server as a domain controller. A domain controller is a computer that maintains the security database, including user accounts and groups, for the domain. With a domain user account, you can log on to any computer in the domain (subject to your privileges set at the domain level and on individual computers), and you can gain access to permitted resources anywhere on the network.

If you participate in a domain, you might come across some additional domain groups. These include the predefined groups Domain Admins, Domain Guests, and Domain Users, as well as other domain groups set up by your administrator. Domain groups can include users who access your computer from other parts of the domain. They can be set up only on a system running Windows 2000 Server.

SEE ALSO
For information about logging on with a domain account vs. a local account, see Appendix B, "Logging On and Logging Off."

In general, if your computer is part of a Windows 2000 domain, you shouldn't need to concern yourself with local user accounts. Instead, all user accounts should be managed at the domain controller. But you might want to add certain domain user accounts or groups to your local groups. By default, the Domain Admins group is a member of the local Administrators group, and Domain Users is a member of the local Users group; members of those domain groups thereby assume the rights and permissions afforded to the local groups to which they belong.