We have a network with Windows 7 Enterprise machines, all members of a domain. We've been keeping a local (unlocked) 'Admin' account on each workstation in parallel to the built-in (locked) 'Administrator' account. Since installation of the OS requires an initial account to be created before the computer is joined into the domain, we've left the 'Admin' account with a strong password as it is. However, this requires the same password to be used across machines, and possibly never expiring.
Note that in our environment we don't restrict users (mostly developers) much and don't plan to do so. Usually domain user accounts are members of the Administrators group on respective desktops. On the other hand, we try to keep things centrally managed.
What are the pros and cons of keeping such local (non-domain) admin accounts on domain-joined workstations in respect to:
- data access
- problem solving