Your network contains an Active Directory Domain Services (AD DS) forest.

Read-only domain controllers support a feature called Administrator Role Separation, which allows an administrator to designate a specific domain user as a local administrator of one particular RODC without granting that user any domain-wide administrative rights whatsoever, which is exactly what satisfies the principle of least privilege in this scenario. This role separation is configured using ntdsutil.exe, specifically through its local roles management menu, where a command such as adding CONTOSO\User1 to the administrators role is run against the target RODC to grant User1 local administrative access to just that one domain controller. Computer Management ' s Local Users and Groups snap-in does not expose or apply the same role-separation mechanism when used against a domain controller, since domain controllers do not maintain a separate local SAM database of local users and groups the way member servers do. dsamain.exe is used to expose a static, offline snapshot of an Active Directory database, such as one restored from a backup, for browsing and comparison purposes, which is unrelated to granting administrative rights. The net user command only creates or modifies domain or local user account properties; it does not add a user to an RODC ' s local administrative role, so ntdsutil.exe is the only tool listed that correctly accomplishes this least-privilege delegation.