You are setting up user accounts after transforming a Windows workgroup into a small domain. What is the BEST way to manage user account security?

According to the principle of least privilege, you should only grant users the minimal amount of access necessary for them to do their job. Assigning permissions to groups rather than individuals is another best practice, and users should be added to groups (or removed from them) as they change roles or positions.