Windows 2000 Local vs Domain User Accounts

Microsoft Windows 2000 handles user identity by distinguishing between local user accounts, which are restricted to individual workstations and member servers, and domain user accounts, which are centrally managed across an entire network using Active Directory. This article examines how Windows 2000 manages both account types, highlighting their storage locations, authentication protocols, management tools, and administrative scopes.

Storage and Architecture

Windows 2000 stores and organizes user data differently depending on the account type:

  • Local User Accounts: These accounts reside on the individual computer where they are created. The account information is stored in the local Security Accounts Manager (SAM) database file located in %SystemRoot%\System32\Config\SAM. Standalone systems, workgroup computers, and member servers maintain their own distinct SAM databases. Domain controllers in Windows 2000 do not maintain an accessible local SAM for standard logins; instead, the SAM is disabled for regular interactive use once a server is promoted to a domain controller.
  • Domain User Accounts: Introduced with Windows 2000, Active Directory serves as the central directory service for domain accounts. Rather than using the SAM database, domain user credentials and attributes are stored within the Active Directory database file (NTDS.dit). This database replicates across all domain controllers within the domain, providing redundancy and centralized access.

Authentication Protocols

Authentication determines how Windows 2000 verifies a user's identity when logging on:

  • Local Authentication: When a user logs on using a local account, the Local Security Authority Subsystem Service (LSASS) evaluates the supplied username and password against the local SAM database. The system typically employs the NTLM (NT LAN Manager) authentication protocol. Access granted is confined strictly to the local machine's resources unless identical credentials exist on other network machines.
  • Domain Authentication: When a user logs in to a domain account, authentication is processed by a domain controller. Windows 2000 introduced Kerberos version 5 as the default protocol for domain authentication, replacing the legacy NTLM used in Windows NT 4.0. Kerberos provides faster authentication, mutual authentication between client and server, and enables Single Sign-On (SSO) across enterprise resources.

Administrative Tools

Windows 2000 uses Microsoft Management Console (MMC) snap-ins to administer both types of accounts:

  • Local Account Management: Administrators use the Local Users and Groups snap-in (available inside the Computer Management console, compmgmt.msc). This tool allows administrators to create accounts, reset passwords, disable users, and assign them to local groups such as Administrators, Power Users, or Users.
  • Domain Account Management: Administrators manage domain accounts using the Active Directory Users and Computers snap-in (dsa.msc). This console allows administrators to create domain user objects, organize them into Organizational Units (OUs), configure account policies (such as password expiration and lockout thresholds), and delegate administrative authority.

Scope and Resource Access

The operational scope defines the capabilities and administrative overhead of each account type:

  • Local Accounts: Ideal for small peer-to-peer networks (workgroups) or isolated machines. A local account cannot access resources on other systems without secondary authentication. Managing local accounts across multiple computers requires manual updates on each machine, increasing administrative overhead.
  • Domain Accounts: Designed for enterprise networks. A single domain account allows a user to log on to any compatible workstation joined to the domain. Group Policy Objects (GPOs) can be linked to domain accounts and OUs, providing centralized control over desktop environments, security configurations, and software deployment. Access to network shares, printers, and servers is controlled centrally through Active Directory security groups.