Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's take a computer, A, in a domain. There are 2 "administrator" login accounts for this computer, "administrator" and "domain\administrator"

How different are they?

Do my actions have any difference whether I manipulate the computer with the domain administrator or the computer administrator? What is the best practice here? Keep both?

share|improve this question
up vote 10 down vote accepted

Any Windows computer (*) has a local user database, which contains local user accounts and local groups; these user accounts can perform actions (logging in, launching programs, configuring settings...) on the computer according to their rights, but have no validity anywhere else, because they only exist on that computer.

Any domain has a domain user database, which contains (amongst other things) domain user accounts, domain groups and domain computers. When a computer joins a domain, the domain users become valid users on that computer, and they can perform actions on it according to their rights; the default rights are as such:

  • All domain users are members of the domain group "Domain Users".
  • All domain administrators are members of the domain group "Domain Admins".
  • The domain group "Domain Users" is member of the local "Users" group on each domain computer.
  • The domain group "Domain Admins" is member of the local "Administrators" group on each domain computer.

This mean that, according to default settings, domain users are valid users on every domain computer, and domain administrators have administrative rights on all of them.

When you use a local account, you can only act on the local system, according to your rights.
When you use a domain account, you can act on all domain computers (f.e. open network shares, run remote administration tools, etc.) and on the domain itself (f.e. configure user accounts, policies, etc.), according to your rights.

(*) Domain controllers are the only exception, as they don't have a local user database; they only work with domain users and groups.

share|improve this answer

The local admin account has full control over the local machine. It is a default account and needed. The domain\Administrator is added when the system joins the domain. This gives the computer access to network resources as the Domain Administrator. Naturally, how security on the domain and local system is configured will also have an impact.

share|improve this answer

The local Administrator account is important. To run Windows Startup Repair, you need to authenticate with local credentials, among plenty of other things that would require it.

share|improve this answer
Am I incorrect? – Bigbio2002 Mar 7 '12 at 18:13
(I didn't downvote). I don't think you're incorrect, but Windows Startup Repair is somewhat rarely used in larger environment, like never. And this doesn't answer how the accounts are different, nor what are best practices, it doesn't answer the Question. – Chris S Mar 7 '12 at 20:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.