>2) Use User Manager (remotely, preferably) in local domain to Add/Modify/Remove users from local domain groups.
Er, make this just "Add/Remove" users from domain groups - he doesn't need to "modify" anything, an admin will handle that.
The Anonymous Bureaucrat,
and frankly, quite content not to be
a member of either major US political party.