Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

MS have taken great pains to remove 'Local Users and Groups' from the GUI tools, and even if you tickle up lusrmgr.msc directly it complains that the snap-in won't run on a domain controller.

The question is "why not?" Why doesn't it make sense for a DC to have local security groups?

share|improve this question
up vote 12 down vote accepted

In short, the "local users" become "domain users". Microsoft opt'ed to only allow 1 authentication repository for 1 computer. When you promote a computer to a domain controller, the local authentication repository is used to store domain accounts. Since there is no longer a set of local users/groups/etc... you're only left with domain users & accounts. In all honesty, having "local" users on a domain controller really defeats the purpose of having a domain controller in the first place.

share|improve this answer
Entirely correct. "Local" means "not in the domain." This is the way MS designed AD. – mfinni Apr 28 '11 at 14:14
OK, that makes sense. So the implications of this are: that the "local authentication repository" in the case of a DC happens to be AD, and the groups/users defined in that repository have a domain scope? – David Bullock Apr 28 '11 at 14:23
Exactly. I believe that the tools you would use to work with local-users/groups/etc... also will no longer allow you to create local users/groups/etc. – TheCompWiz Apr 28 '11 at 14:30
Also, where a non-DC computer might have the notion of a 'Local Administrators' group, does a DC respect a domain group? Is that group the 'Domain Administrators'? – David Bullock Apr 28 '11 at 14:31
The domain equivalant to the Local Administrators group is the Builtin\Administrators group. When you promote a server to a DC the local groups are converted into Builtin groups in the domain. If you look in the Bultin container in ADUC you'll see the domain groups that were formerly local groups. Also, What do you mean "Does a DC respect a domain group"? – joeqwerty Apr 28 '11 at 14:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.