Active Directory faking account lock outs

Create a group policy that uses the restricted groups feature to place "Domain Users" in the "Remote Desktop Users" group. Apply that policy to your server, overriding the local policy. Log in as domain admin and make sure the policy refreshes. When you examine the remote desktop users group, verify that "domain users" has been placed in this group. Now, log off and test as one of your domain users.

What are the pros and cons of keeping such local (non-domain) admin accounts on domain-joined workstations in respect to:

Security

There's little difference. An account with administrative privileges can destroy a machine. This is true whether we're talking about a domain or local account. Some would argue that the local Administrator account is more vulnerable to attack simply because it's a well-known username. If that's a concern, you can always change the account's username with a GPP although this doesn't mitigate attacks that rely on the account's well-known SID, which cannot be changed. IMHO it's more important to use a strong password than try to evade unwanted logon attempts.

One noteworthy difference unique to the local administrator account is that by default it automatically bypasses UAC. This is meaningless if an attacker is logged in; UAC won't stop him. However, UAC can be useful to help protect a legitimate admin. This behavior can be changed through GP eliminating it as a difference.

Management

Local accounts are harder to manage. And not just the local Administrator account. Changing a domain account is easily done in one place, affecting all computers where the account is used. A local account can only be modified on the workstation where it exists. However, with the advent of Group Policy Preferences, some local account changes (e.g. renaming the local Administrator to something else [see above]) can be managed with Group Policy. There are also utilities available for changing local account passwords.

Data Access/Problem Solving

A local administrator account is indispensable. Only the previous 10 domain accounts to successfully logon a machine can still logon in the event connectivity to a DC is lost (this number is configurable). If none of these accounts have local admin privileges and you're troubleshooting a machine that can't establish a network connection, you're stuck. Even access to the Recovery Console won't be possible (at least without hacks). But with an available local Administrator account, you never have to worry about this happening. For this reason alone I have a local admin account on all domain machines I manage, including (especially) servers.