when the account is first created, the choice of accounts is presented. If an account is placed in the domain users account, rights and permissions are for domain users. Adding that account to an administrator's security account does not necessarily elevate that user to administrator status [because the account is a domain user account]. In processing permissions, for access, the most restrictive permissions apply. Therefore in the case of a domain user account which is also a member of the administrator's security account, the most restrictive [domain user] applies. If you want administrator access in the domain, one must elevate a user account to administrator level in essence change the account to an administrator's account from a domain user account.
Just create a new account and make that account a domain administrator's account.
There are many security features in a domain, one of which restricts access to local machine log on. If an account is to have local machine administrator access and is a domain user account, the domain user account should be a local machine administrator AND the user log on locally to be granted administrator privileges to the local machine. Policy is processed local machine, site, domain and OU in that order. granting domain users administrator status to a local machine does not guarentee that the domain user has access to the local machine while logged in to the domain as a domain user.
