WSM is joined to the domain by the client at which point the client determines who has access to administrative functions on the server i.e. RDP.
WSM is a website configured on IIS which is restricted to domain authentication. The administration features of the product are controlled by users associated with the default “Sys Admin” role.
Standard users will have access to the self-service portal by default. This can be disabled.