MS have taken great pains to remove 'Local Users and Groups' from the GUI tools, and even if you tickle up lusrmgr.msc directly it complains that the snap-in won't run on a domain controller.

The question is "why not?" Why doesn't it make sense for a DC to have local security groups?


In short, the "local users" become "domain users". Microsoft opt'ed to only allow 1 authentication repository for 1 computer. When you promote a computer to a domain controller, the local authentication repository is used to store domain accounts. Since there is no longer a set of local users/groups/etc... you're only left with domain users & accounts. In all honesty, having "local" users on a domain controller really defeats the purpose of having a domain controller in the first place.

  • 2
    Entirely correct. "Local" means "not in the domain." This is the way MS designed AD.
    – mfinni
    Apr 28 '11 at 14:14
  • OK, that makes sense. So the implications of this are: that the "local authentication repository" in the case of a DC happens to be AD, and the groups/users defined in that repository have a domain scope? Apr 28 '11 at 14:23
  • Exactly. I believe that the tools you would use to work with local-users/groups/etc... also will no longer allow you to create local users/groups/etc.
    – TheCompWiz
    Apr 28 '11 at 14:30
  • Also, where a non-DC computer might have the notion of a 'Local Administrators' group, does a DC respect a domain group? Is that group the 'Domain Administrators'? Apr 28 '11 at 14:31
  • 3
    The domain equivalant to the Local Administrators group is the Builtin\Administrators group. When you promote a server to a DC the local groups are converted into Builtin groups in the domain. If you look in the Bultin container in ADUC you'll see the domain groups that were formerly local groups. Also, What do you mean "Does a DC respect a domain group"?
    – joeqwerty
    Apr 28 '11 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.