Log into Computer or Domain

To be a little more clear, this is a small network with file and print sharing only. No fancy Web page interface or anything like that. Although there might be a need for remote access some time in the future.

If the user logs into the computerand not the domain, he still can gain access to shared files on the file server and shared printers. If access to shared files and printers is really the only function of the network, what are the advantages of loging into the domain?

Thanks -Jimmy

Logging onto the computer as admin allows you to make changes at all levels. the logon administrator (local) is the default for all window machines. the logon administrator (network) is usually reserved for the Syatem Administrator (or his assigned minions). the two logons are in fact different, as you can se by looking at the profiles (NT4.0), or Documents and Settings (W2K pro/server/etc). the usuall path is to logon to the machine local, as administrator and then by going to the groups add from the network a user with whatever priveleges are needed (usually assigned by the admin on the server according to corp/school/orginization policy.
if you are just setting up the machine here are the usual logins
1. administrator (local) full priv
2. nameduser (local) assigned priv
3. networkuser (network) domain assigned priv
4. netadmin (network) so the sys admin can access all boxes he is responsible for

usually the named user is added as a backup logon in case the admin password islost/ and or the priveleges are revoked, policy may not allow you to do this. most networks dont allow you to access internal machines on your domain or the network unless you are logged on as a network logon (which has you priv/permissions/passwords on the server) big security issue.
make sure you know the local policy before you attempt to make changes, dont make the sa mad, he/she can make your life hell. let me know if you need more info............

Another clarification. I'm not talking about logging into the computer as the administrator. I'm talking about logging into the computer as a user versus logging into the domain as that same user.

Yes the server is a primary domain controller.

Selecting an option from the drop down determines where you profile will be used.
Selecting Computer uses the users and groups from the local computer
Selecting Domain uses the groups and users from the Domain.
eg. you may be an administrator on your local machine but only a user on the domain, logging on to your computer would give you full priveliges on your computer, but next to none on the domain.
best option would be to create a group with admin rights to your computer in the domain and add yourself to that group, then logon to the domain, you then get your domain rights and admin rights on your workstation.

My guess is that you have no priviliges and/or restrictions defined in your network domain. That's why you don't see any difference whether your user logs into the computer or logs into the domain. Just as you can set those priviliges on the computer, you can also set them for the domain. You set those network priviliges and/or restrictions on the PDC (primary domain controller).

For example, when the user logs into the computer and then attempts to map a network drive to a shared device on the network, there are no "rules" in place to either allow or restrict that particular user from using that shared device. If you take that same example a bit further, you could allow access to a particular shared device (drive, folder, printer, etc.) to only certain users. That would restrict all other users from access to that device - the users who do not have that permission as defined on the PDC.

Domain defined:

Windows NT (and 2000) uses the idea of a domain to manage access to a setof network resources (applications, printers, and so forth) for a group of users. The user need only to log into the domain to gain access to the resources, which may be located on a number of different servers in the network. One server, known as the primary domain controller, manages the master user database for the domain. One or more other servers are designated as backup domain controllers. The primary domain controller periodically sends copies of the database to the backup domain controllers. A backup domain controller can step in as primary domain controller if the PDC server fails and can also help balance the workload if the network is busy enough.

(continued...)

Hi Jimmy,

their are many differences between the two Logon possibilitys. The mean difference is when you logon local(into your computer not domain) you authenticate against the local SAM (Security Account Manager), and the user must authenticate again to all Ressources he/she wants to use in the network again and again. Otherwise he gain no access to Ressources in the Network. W2k Pro is able to chache this account for some time, but not for ever.

If she/he logs into the Domain, he/she authenticates again the Domain Controller and receiives a token for accessing all Ressources in the network who are Members of the Domain. Theirs is no need for multiple authentication etc. The benefits for your User: one logon to all Ressources in the Network now and for the future. Benefits for the Admin: The one Point of Administration.

Hope it helps

regards
Frobo