how to tell if it is a local user account or domain user account?

5 Apr 2005 12:49 PM

ykffc

Simple: but I am a bit confused.

For a Window2000 Pro desktop configured to part of a domain, after I click
on control panel, users and password, I see the following accounts
(username/domain/group):

Administrator/myComputerName/Administrator
xxx/myDomainName/PowerUser

I believe "Administrator" is the build in local administrator account.

Question 1: just by viewing the above data, can we say xxx must be a valid
domain account in myDomainName.

Question 2 is: if myDomainName/yyy is a valid domain user account in
MyDomainName, do I always have to add this user account onto the PC before
user yyy can logon to this computer? (but yyy is not in the list)

Question 3 is: similarly if myaDomainName/Administrator is a valid account
in myDomainName domain and has domain administration right, do I still need
to add the user name data to this desktop before this domain user can log on?

I just start learning security and hope the question make sense.

5 Apr 2005 2:04 PM

Dave Patrick

"ykffc" wrote:
| Simple: but I am a bit confused.
|
| For a Window2000 Pro desktop configured to part of a domain, after I click
| on control panel, users and password, I see the following accounts
| (username/domain/group):
|
| Administrator/myComputerName/Administrator
| xxx/myDomainName/PowerUser
|
| I believe "Administrator" is the build in local administrator account.
|
| Question 1: just by viewing the above data, can we say xxx must be a valid
| domain account in myDomainName.

* No because it might be cached info you're looking at.

| Question 2 is: if myDomainName/yyy is a valid domain user account in
| MyDomainName, do I always have to add this user account onto the PC before
| user yyy can logon to this computer? (but yyy is not in the list)
* No

| Question 3 is: similarly if myaDomainName/Administrator is a valid account
| in myDomainName domain and has domain administration right, do I still
need
| to add the user name data to this desktop before this domain user can log
on?

* No but you'll probably want to add the domain administrator account to the
list of local administrators.

FYI;
On a newly-joined-to-the-domain PC if you logon to the pc first, then to the
domain you would end up with two profiles.
%username%
and
%username%.%userdomain%
Else if you logon to the domain first, then to the pc you would end up with
%username%
and
%username%.%computername%

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

5 Apr 2005 8:13 PM

ykffc

Excellent, I learn things I didn't know of.

1) I usually create a local user account and specify its type (whether it is
a local user or domain user, user group..) before letting the domain user to
logon. By doing this, does it stuff up? Now you tell it is not necessary, but
if there any advantages at all?

2) How many different TYPE of user profiles are there? I thought there are
only two types: either it is "local" or "domain". In FYI part of your
response , it appears there are three types.

Thanks again.

Show quoteHide quote

"Dave Patrick" wrote:

> "ykffc" wrote:
> | Simple: but I am a bit confused.
> |
> | For a Window2000 Pro desktop configured to part of a domain, after I click
> | on control panel, users and password, I see the following accounts
> | (username/domain/group):
> |
> | Administrator/myComputerName/Administrator
> | xxx/myDomainName/PowerUser
> |
> | I believe "Administrator" is the build in local administrator account.
> |
> | Question 1: just by viewing the above data, can we say xxx must be a valid
> | domain account in myDomainName.
> * No because it might be cached info you're looking at.
>
> | Question 2 is: if myDomainName/yyy is a valid domain user account in
> | MyDomainName, do I always have to add this user account onto the PC before
> | user yyy can logon to this computer? (but yyy is not in the list)
> * No
>
> | Question 3 is: similarly if myaDomainName/Administrator is a valid account
> | in myDomainName domain and has domain administration right, do I still
> need
> | to add the user name data to this desktop before this domain user can log
> on?
> * No but you'll probably want to add the domain administrator account to the
> list of local administrators.
>
> FYI;
> On a newly-joined-to-the-domain PC if you logon to the pc first, then to the
> domain you would end up with two profiles.
> %username%
> and
> %username%.%userdomain%
> Else if you logon to the domain first, then to the pc you would end up with
> %username%
> and
> %username%.%computername%
>
>
> --
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
>
>

5 Apr 2005 8:42 PM

Dave Patrick

"ykffc" wrote:
| Excellent, I learn things I didn't know of.
|
| 1) I usually create a local user account and specify its type (whether it
is
| a local user or domain user, user group..) before letting the domain user
to
| logon. By doing this, does it stuff up? Now you tell it is not necessary,
but
| if there any advantages at all?

* Correct it isn't necessary. The local profile will likely never be used so
consuming space unnecessarily. The passwords can be different depending on
if the user logs on locally or to the domain.

| 2) How many different TYPE of user profiles are there? I thought there are
| only two types: either it is "local" or "domain". In FYI part of your
| response , it appears there are three types.

* These links may help.

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/4834a53c-7fa3-4858-af5d-0394b0cf2474.mspx

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/DepKit/f12634de-a2bc-4912-adae-6bedd4ff1483.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect