1

Let's take a computer, A, in a domain. There are 2 "administrator" login accounts for this computer, "administrator" and "domain\administrator"

How different are they?

Do my actions have any difference whether I manipulate the computer with the domain administrator or the computer administrator? What is the best practice here? Keep both?

3 Answers 3

11

Any Windows computer (*) has a local user database, which contains local user accounts and local groups; these user accounts can perform actions (logging in, launching programs, configuring settings...) on the computer according to their rights, but have no validity anywhere else, because they only exist on that computer.

Any domain has a domain user database, which contains (amongst other things) domain user accounts, domain groups and domain computers. When a computer joins a domain, the domain users become valid users on that computer, and they can perform actions on it according to their rights; the default rights are as such:

  • All domain users are members of the domain group "Domain Users".
  • All domain administrators are members of the domain group "Domain Admins".
  • The domain group "Domain Users" is member of the local "Users" group on each domain computer.
  • The domain group "Domain Admins" is member of the local "Administrators" group on each domain computer.

This mean that, according to default settings, domain users are valid users on every domain computer, and domain administrators have administrative rights on all of them.

When you use a local account, you can only act on the local system, according to your rights.
When you use a domain account, you can act on all domain computers (f.e. open network shares, run remote administration tools, etc.) and on the domain itself (f.e. configure user accounts, policies, etc.), according to your rights.


(*) Domain controllers are the only exception, as they don't have a local user database; they only work with domain users and groups.

1

The local admin account has full control over the local machine. It is a default account and needed. The domain\Administrator is added when the system joins the domain. This gives the computer access to network resources as the Domain Administrator. Naturally, how security on the domain and local system is configured will also have an impact.

0

The local Administrator account is important. To run Windows Startup Repair, you need to authenticate with local credentials, among plenty of other things that would require it.

2
  • Am I incorrect?
    – Bigbio2002
    Mar 7, 2012 at 18:13
  • 1
    (I didn't downvote). I don't think you're incorrect, but Windows Startup Repair is somewhat rarely used in larger environment, like never. And this doesn't answer how the accounts are different, nor what are best practices, it doesn't answer the Question.
    – Chris S
    Mar 7, 2012 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .