What are local user accounts and local groups in Windows Server

A user account is a security principals object for an end user to access the resources available on a computer. A user account can be a user account for a human user, a user account for a software, a user account for the Operating System services, or an account for a computer. Two types of user accounts and groups in Windows Server Operating Systems are 1) local user accounts and groups and 2) Active Directory user accounts and groups. Active Directory user accounts and groups are not in our current scope of study. Active Directory user accounts and groups are somewhat advanced topic and we will discuss Active Directory user accounts and groups later, in another lesson.

Let us try to understand what are local user accounts and groups.

Local user accounts

Local user accounts are created on a single Windows Server Operating System and local user account cannot be used to login to another Windows Server. Local user accounts are authenticated by the Windows Server Operating system, normally by a combination of user–id and password strings. Local user accounts can be assigned rights and permissions on the local Windows Server Operating System only.

Local user accounts and security groups are security principals in Windows Server Operating System. A security principal is any entity that can be authenticated by the Windows Server Operating System. Security principals are assigned with SIDs (security identifiers).

Following screenshot shows the default user accounts created after a fresh Windows Server 2025 installation.

Local groups

Local security groups are used to hold local users or other groups together. The main purpose of local security groups is to simplify the management of security permissions for the resources available on Windows Server Operating Systems.

For example, let us assume that there is a common file directory available in a Windows Server based and that common file directory is meant only for three user accounts in that Windows Server. We can add those three user accounts in a security group and assign permission to only that security group for that common file directory, instead of adding three individual user accounts one–by–one. The advantage is that, that security group can be reused to assign permission for another resource, for a similar situation later.

Following screenshot shows the default groups created after a fresh Windows Server 2025 installation.

Written by Jajish Thomas.
Last updated on 27^th July, 2024.