Gaining access to the resources of the SBS network requires a domain user account, which authenticates the identity of the person making the connection and controls what resources a user has the right to access.
In Windows SBS 2011, by default all user accounts fall into one of three roles, or categories:
Standard User with Administration Links
Each user account you add will be based on one of these user roles (or on another user role that you create). In the interests of sanity (your own), keep the number of user roles to a minimum. It is far easier to control access through group membership rather than creating multiple user roles. You also have the ability to change the specifics of access ...