Any Windows computer (*) has a local user database, which contains local user accounts and local groups; these user accounts can perform actions (logging in, launching programs, configuring settings...) on the computer according to their rights, but have no validity anywhere else, because they only exist on that computer.
Any domain has a domain user database, which contains (amongst other things) domain user accounts, domain groups and domain computers. When a computer joins a domain, the domain users become valid users on that computer, and they can perform actions on it according to their rights; the default rights are as such:
- All domain users are members of the domain group "Domain Users".
- All domain administrators are members of the domain group "Domain Admins".
- The domain group "Domain Users" is member of the local "Users" group on each domain computer.
- The domain group "Domain Admins" is member of the local "Administrators" group on each domain computer.
This mean that, according to default settings, domain users are valid users on every domain computer, and domain administrators have administrative rights on all of them.
When you use a local account, you can only act on the local system, according to your rights.
When you use a domain account, you can act on all domain computers (f.e. open network shares, run remote administration tools, etc.) and on the domain itself (f.e. configure user accounts, policies, etc.), according to your rights.
(*) Domain controllers are the only exception, as they don't have a local user database; they only work with domain users and groups.