Skip to main content
AD Academy
Back to topics
From Zero: Network, Server and Domain
Beginner10 minLast updated: Topic 3 of 4

Workgroup vs Domain

Why an organization moves to centralized management and what it actually gives you.

Not read

What you will learn here

  • Workgroup vs Domain
  • Why companies move to central management
  • What it gives you in practice

Worth reading first:DNS — the heart of Active Directory

In a Workgroup, every computer stands on its own: each computer has its own users and its own passwords. With 5 computers it works, with 50 it's a nightmare.

  • Workgroup — no central management, no unified policy, a separate password on every computer.
  • — a central database ( DS), one account for all computers, unified policy (), organized permissions management.
Architecture and Theory — Under the Hood

Workgroup = decentralized management. Each computer holds its own user database (local SAM) and authenticates locally. = centralized management — all authentications go through a DC, and permissions are configured once.

  • In a Workgroup: 20 computers = 20 user databases. Admin password changes — change on 20 devices.
  • In a : A domain user can log in to any computer that is a member of it, and enforces a uniform policy.
  • Transition from Workgroup to : Add-Computer + reboot. The local profile does not move — a new profile is created.
Practical Configuration (PowerShell / GUI)
# Join Domain
Add-Computer -DomainName corp.local -Credential CORP\Administrator \
  -OUPath 'OU=Workstations,DC=corp,DC=local' -Restart

# Leave Domain (Return to Workgroup)
Remove-Computer -UnjoinDomainCredential CORP\Administrator -WorkgroupName WORKGROUP -Restart
powershell
Real-world Scenarios in an Organization
  • Small business (5 computers) — Workgroup + identical passwords + OneDrive sync.
  • Law firm (30 computers) — with + drive mapping + centralized printing.
  • Factory with 200 devices — is mandatory, perhaps a few Sites.
Troubleshooting
  • 'The trust relationship failed' — Computer account password not synchronized. Solve: Reset-ComputerMachinePassword or Test-ComputerSecureChannel -Repair.
  • After joining — User cannot find the old profile. Solution: Manual copy or User Profile Wizard.
Glossary and Quick Command Line
  • SAM = Local user database.
  • NETLOGON = Service that manages the trust channel with the DC.
  • More than 10 devices = .

Check yourself

What is the main advantage of a Domain over a Workgroup?

Was this page helpful?

PreviousNext