Domain – How to join Win2k3 domain AND properly set up UAC account with Windows 7

From SuperUser:

For all apps with requestedPrivilegeLevel="highestLevel" in their manifest, you can use Microsoft's Application Compatibility Toolkit 3 to shim the application with the RunAsInvoker fix, which forces the app to run with your standard user tokens.

What are the pros and cons of keeping such local (non-domain) admin accounts on domain-joined workstations in respect to:

Security

There's little difference. An account with administrative privileges can destroy a machine. This is true whether we're talking about a domain or local account. Some would argue that the local Administrator account is more vulnerable to attack simply because it's a well-known username. If that's a concern, you can always change the account's username with a GPP although this doesn't mitigate attacks that rely on the account's well-known SID, which cannot be changed. IMHO it's more important to use a strong password than try to evade unwanted logon attempts.

One noteworthy difference unique to the local administrator account is that by default it automatically bypasses UAC. This is meaningless if an attacker is logged in; UAC won't stop him. However, UAC can be useful to help protect a legitimate admin. This behavior can be changed through GP eliminating it as a difference.

Management

Local accounts are harder to manage. And not just the local Administrator account. Changing a domain account is easily done in one place, affecting all computers where the account is used. A local account can only be modified on the workstation where it exists. However, with the advent of Group Policy Preferences, some local account changes (e.g. renaming the local Administrator to something else [see above]) can be managed with Group Policy. There are also utilities available for changing local account passwords.

Data Access/Problem Solving

A local administrator account is indispensable. Only the previous 10 domain accounts to successfully logon a machine can still logon in the event connectivity to a DC is lost (this number is configurable). If none of these accounts have local admin privileges and you're troubleshooting a machine that can't establish a network connection, you're stuck. Even access to the Recovery Console won't be possible (at least without hacks). But with an available local Administrator account, you never have to worry about this happening. For this reason alone I have a local admin account on all domain machines I manage, including (especially) servers.