When computers are members of a domain, you typically use domain accounts to log on to computers and the domain. All administrators in a domain have access to resources on the local workstations that are members of the domain. Users, on the other hand, can access resources only on the local workstations they are permitted to log on to. In a domain, any user with a valid domain account can by default log on to any computer that is a member of the domain.
Once logged on to a computer, the user has access to any resource that his or her account or the groups to which the user’s account belongs are granted access. This includes resources on the local machine as well as resources in the domain.
You can restrict logons to specific domain workstations on a per-user basis by using Active Directory Users And Computers. In Active Directory Users And Computers, right-click the user account and then click Properties. On the Account tab of the user’s Properties dialog box, click Log On To, and then use the options on the Logon Workstations dialog box to designate the workstations to which the user is permitted to log on.
When you work with Windows 7, however, you aren’t always logging on to a domain. Computers configured in workgroups have only local accounts. You might also need to log on locally to a domain computer to administer it. Only users with a local user account can log on locally. When you log on locally, you have access to any resource on the computer that your account or the groups to which your account belongs are granted access.
