Local user vs. domain user? What is the right way here?

Question

I'm a software developer in a company with 6 employees. Everyone has a machine for him-/herself, so none of the machines is shared.

I'm currently setting up my machine with Windows 8 and was experimenting a bit with domain and local user accounts.

Correct me please if I'm wrong, but I think the idea behind is, that domain users generally should not be able to modify the configuration of a machine (like installing software), since they are able to login on every single machine in the domain. The local user (usually just one local administrator per machine) is the one who cares about the configuration of the machine.

But in my case the login into the domain is just for being able to access directories/servers in the domain (I do not really know the details, all I know is, that loggin into the domain user account is necessary). So overall I've got a local admin account and a domain account used on my machine. While working I'm logged in to my domain user account. But it annoys me, that I always need to enter the credentials of my local user account when I'm about to update/install something, which happens quite often as a software developer.

I fixed this with adding the domain account into the user accounts in my control panel and putting it into the Administrators group.

The only thing I wanted to know about this: is there something REALLY bad about doing this? Or is there maybe a more common way to be able to act like a local admin, while logged in as a domain user?

PS: I'm sorry about the tags, but I don't know the proper ones. I'd be glad if some of the superuser experts could fix this :-)

Solution

The way you've accomplished this is perfectly acceptable, and allows that one user to have Administrator privileges over that one PC. I use the same procedure to allow trusted users to toy with their machines, while stopping them messing up anyone elses.

You can then delete the local accounts to avoid duplication or confusion.

Comments

[Zeph]

If I delete my local account, I should activate the by default deactivated Adminstrator account, shouldn't I? And is it possible that when I start up my machine, per default DOMAINNAME\username is already entered (account already selected)? I'd like to just enter my password and forget about typing the domain- and username, everytime I (re)start my machine. And is it also possible to log into the domain with the Microsoft account (email as username)? I don't think so...

[Graham Wager]

I've never bothered leaving a local account on there, but you can if you prefer to err on the side of caution. Just remember to set its password as it's blank by default. The requirement to enter DOMAINNAME\... is because of the local account with the same name, so this will go when it is deleted, and the last login will by default remain entered. Finally, you can link your MS account to your domain account after login from the PC Settings/Users area.

[Zeph]

Thanks for perfectly answering my question. I figured already out, how to link the domain account with the MS account, thanks!