Windows NT enables you to manage user accounts either centrally or decentrally. With centralized management, there is usually one directory database and, therefore, one master domain, in which all user-account information is stored. Users are defined on the network only once and are given access permissions to resources based on their logon identity in the central user database. The single-domain model and single master-domain models are centrally managed. A multiple master-domain model can also be centrally managed by adding designated administrators to appropriate Admin groups.
With decentralized management, more than one directory database contains information about different user accounts in the organization. You can create trust relationships to enable domains to access resources in other domains. The multiple master-domain model and the single-domain models can use decentralized management.
In planning your domain model, you'll need to establish administrative policies and procedures for how you will: