Standalone vs. Workgroup vs. Domain
Each workstation is a member of a workgroup or a domain. Most businesses will have workstations connected to a domain for management of the resources by the System Administrator.
A domain is one or more servers running Windows Server with all of the servers functioning as a single system. The domain not only contains servers, it contains workstations and workgroup machines. The user and group database covers all of the resources of a domain.
Domains can be connected together through trusted domains. The advantage of trusted domains is that a user only needs one user account and one password to gain access to the resources across multiple domains., and administrators can manage the resources centrally.
A workgroup is simple a grouping of workstations that do not belong to a domain. A standalone workstation is a special case workgroup.
User and group accounts are handled differently between domain and workgroup situations. User accounts can be defined on a local or domain level. A local user account can only log on to that local computer, while a domain account can log on from any workstation in the domain.
Global group accounts are defined at a domain lever. A global group account is an easy way to grant access to a group of users in a domain. Local group accounts are defined on each computer. A local group account can have global group accounts and user accounts as its members.
In a domain, the user and the group database is shared by the servers. Workstations in the domain do not have a copy of the user and the group database, but can access the database on the server. In a workgroup, each computer in the workgroup has its own database, and does not share this information.