Use the Administrator account to create other users for your domain. Grant the users permissions by adding them into groups. There are built-in groups for various administrative tasks on the domain. To assign custom permissions or resource permissions, create groups and add the appropriate users. Global groups can be assigned permissions anywhere in the domain.
Global groups can only contain users.
Local groups can only be assigned permissions on the local machine. Since Domain Controllers share account information, Local groups are identical on all Domain Controllers. Local groups can contain Global groups and users. For maximum flexibility, users should be added to Global groups in the domain by category, then these Global groups should be added to Local groups on the same server as is sharing a resource. Resource permissions should then be granted to these Local groups.