Computers running Windows NT Workstation and Windows NT Server as a member server maintain user accounts, groups, and security policies separate from those of the domain. The built-in accounts on such computers provide built-in rights on the computer that parallel the rights afforded by these corresponding built-in accounts on the domain level.
When a domain controller is configured, its built-in accounts provide the administrator with certain administrative rights. When a workstation or member server is configured, its built-in accounts provide the administrator with administrative rights. To achieve the appropriate level of control over a workstation, member server, or domain, the administrator decides which user accounts to add to the various built-in groups.