Here's what I have figured out so far:
First of all, you have to get "local" users and "domain" users straight
in your head. You set up DOMAIN users and permissions at the server in
Active Directory. LOCAL users are set up on workstations and actually
do not need to be set up at all for a user to access a domain from a
workstation. Local accounts are only for accessing THAT computer, which
would be done by putting the computer's name in the "Log on to" box at
login instead of the domain name.
When you are at a user's workstation and you right click My Computer
and go into Manage, there you will see LOCAL accounts and permissions.
If you look in the GROUPS like Administrator and Power User, these are
only LOCAL administrator and LOCAL power user permissions. Look inside
one of these groups and see is your user's name is there. If they are a
local administrator, they can create users etc on that workstation, but
these are NOT Domain User accounts - these are simply accounts for a
user to logon LOCALLY to that machine. So a person who has local admin
permissions, does NOT have domain admin permissions as well.
FOR EXAMPLE - Mary has a computer that is a member of a domain and she
has local administrative permissions on her computer. She creates a
user account for Suzy on her local machine. Suzy is NOT a domain user
(has no user account on the server), but now she is able to logon to
Mary's machine, but ONLY if she puts in the computer name at the logon
- NOT the domain name. Nothing Mary has done affects the network, only
her local machine. Suzy can logon locally, but she does not have access
to domain resources.
The only way Mary could create DOMAIN user accounts is if she has
domain admin permissions set up on the Server, and even then she could
not do it from her workstation, she would have to access A.D. to set up
those user accounts. So, the whole point here is that the accounts Mary
sets up on her local computer have nothing to do with network logins or
domain accounts. Users that Mary sets up on her local machine can't
access the network.
The other point here is that for a domain, you do not need to set up
ANY local accounts on the workstations. All user accounts are set up on
the server. You can go into the local computer under "Administrator"
and add a domain user to that account (instead of a local user) and
again, that person will only have LOCAL admin privileges, not domain.
I'm sure others have more to add to this, and there is always more to
say, but I don't want to confuse the issue any more than I may have. I
hope this helps. This was a big confusing thing for me in the beginning.
