All users, groups, roles and group policies are managed exclusively at the Domain Controller Krefeld.
Member servers (projects) are In Domain consumers and manage no identities themselves.