I understand DCs do not have "local users and groups". However, if you open LUSRMGR.MSC (alternatively, Control Panel -> User Accounts) on a DC, the Users tab lists SOME accounts in the domain. I'm curious what the logic here is. Are these accounts listed the actual domain account? What is going on here? Why are only some shown?

Hello, A DC has just one account which is DSRM administrator and used for maintenance and disaster recovery purposes. Normally, you should not have such display and if you have then just ignore it since AD users are managed by Active Users and Computers snap-in. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

Hello, A DC has just one account which is DSRM administrator and used for maintenance and disaster recovery purposes. Normally, you should not have such display and if you have then just ignore it since AD users are managed by Active Users and Computers snap-in. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

Hi, Whats the OS version of your DC? Can you reproduce that on all your DCs? I cant reproduce your scenario since when I run lusrmgr.msc or run Control Panel -> User Accounts I get error: The computer xxx is a domain controller. This snip-in cannot be used on a domain controller. Domain accounts are managed with the Active Directory Users and Computers snap-in. And form MS article: You cannot use Local Users and Groups to view local user and group accounts once a member server has been promoted to a domain controller. For more information please refer to following MS articles: Local Users and Groups overview http://technet.microsoft.com/en-us/library/cc785020(v=WS.10).aspxLawrence TechNet Community Support

Hi, Whats the OS version of your DC? Can you reproduce that on all your DCs? I cant reproduce your scenario since when I run lusrmgr.msc or run Control Panel -> User Accounts I get error: The computer xxx is a domain controller. This snip-in cannot be used on a domain controller. Domain accounts are managed with the Active Directory Users and Computers snap-in. And form MS article: You cannot use Local Users and Groups to view local user and group accounts once a member server has been promoted to a domain controller. For more information please refer to following MS articles: Local Users and Groups overview http://technet.microsoft.com/en-us/library/cc785020(v=WS.10).aspxLawrence TechNet Community Support