An enormous portion of any company's overall security posture is making sure that users have proper rights and permissions. You want everyone to be as restricted as possible, while still allowing them to perform the work they need to accomplish for their jobs. When a user logs into a Windows computer, they receive security permissions inside Windows based on what local group or groups they are members of. Out of the box, Standard users have the most restricted rights, Power Users are able to perform some heavier-duty tasks, Administrators have full control within Windows—you get the idea. There are multiple tiers of permissions baked into the operating system.
When your Windows computer is joined to a domain, there are some inherent changes automatically made to these groups. For example, the Domain Admins Active Directory group...