A Windows 2000 network generally requires fewer domains than NT networks, because in NT networks, the domain was the smallest security entity. If you wished to decentralize administrative authority, you needed to create separate domains. Windows 2000 allows for more granular assignment of administrative privileges. In Microsoft networking, a domain is a basic security unit, with a unique name, which provides access to the centralized user accounts and group accounts maintained by the administrator of the domain. Each domain has its own security policies and security relationships with other domains.
Domains can span multiple physical locations.
As the name implies, the network consists of one domain to which all user accounts and resources belong. In the single master domain model, the network is structured into two or more domains, with all user accounts placed in one domain, called the master domain. All users log on to the master domain. Other domains, which can hold computer accounts, shared files, printers, and other network resources, are called resource domains. The advantage of this is that user accounts can be managed centrally, while departments or divisions can manage their own resources.