I'm a developer, not a server admin, so please bear with me!

I've been tasked with checking the installation of some software on a Windows Server 2008 R2 machine in the cloud, within two scenarios:

  1. There is no domain, the software will use local users and groups for authentication
  2. There is a domain, the software will use domain users and groups for authentication

I've done part 1, but I'm puzzled about part 2.

I've just installed the Active Directory Domain Services role on the server, so now I have a domain of one computer. When I look in Active Directory Users and Computers, I see all my original local users and groups. Have they now been 'promoted' to domain users? Or do I not have any domain users yet? Is there a way I can tell the difference between domain users and local users now?


4 Answers 4


Everything that appears within the Active Directory Users and Computers console is in the domain and replicated to all Domain Controllers.

On a Domain Controller (i.e. a server with the Active Directory Domain Services role installed), there are no local users and groups (except for the directory services restore mode user which is a special case).

Member servers and workstations in a domain have their own local users and groups. When a machine is added to a domain, some Domain groups are automatically nested into the local groups; the Domain Admins group becomes a member of the local Administrators group, the Domain Users group becomes a member of the local Users group.

In short though, if the user account appears in the ADUC console, it's a domain account.


You can't test what you want to test on a DC. You'll have to test it on a member server. When a DC is promoted, all accounts except the DSRM account become domain accounts.


Ok, you should first read about Active Directory before doing anything more.

AD is a directory service: it contains users, computers and all sorts of references that are used inside a "security domain", usually a company or department. It's a central location to manage these accounts.

When you install the AD role on a server, all "local" users become domain users. That's one of the reason you typically do NOT install anything on the same machine as AD.

In your case, it doesn't makes any sense to install AD on your server: AD only makes sense if you want to centralize account management between several machines.

Now, if you want to perform your test properly, you will need to remove AD from your server (or, preferably, reinstall it completely), install a separate 2008R2 server on which you will install AD and then join your application server to that domain. Only then can you attempt to use AD accounts for your application.

Be warned, though, that AD isn't just a network service: you need to install all the infrastructure that comes with it (mostly, that's DNS but it also means you'll need a static IP address).

Again, I urge you to start reading about AD: it will not be time lost for anyone who has to work with Windows networks. At the very least, have a look at the Wikipedia article about Active Directory and try reading on of the (numerous) AD beginner's guide available on the net.

  • The purpose of the exercise is to test that the software installer detects the domain and adds application-specific groups to it. I don't have another computer to join into the domain (it's just a virtual server running in the cloud). So I'm not sure how to test the installation on a domain computer that's not the DC...
    – David
    Commented Aug 31, 2012 at 12:06
  • That's pretty much what I'm telling you: on a domain controller, there is no difference between a local user and a domain user. If you want to test if the application can authenticate using a domain account, you need to use a separate machine.
    – Stephane
    Commented Aug 31, 2012 at 14:29

There are a few ways you can check if the server is a member of a domain:

Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Domain

This value will contain the FQDN or will be empty on a workgroup machine.

There's also some Powershell commands you can run to check as well.

The %userdomain% environmental variable will be the machine name if not on a domain too (but if the machine name happens to be the same as the domain, this test will fail. Edge case, yes, but still a possibility).

It would be a safe assumption that if a domain is detected, the user likely wants to use Active Directory authentication, but why not just ask them in the installer? If it's a Windows service you're installing, I absolutely would want to be asked (and have a choice of which user; I would never run a service as an administrator if I didn't have to; least privileges required, that sort of thing).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .