good one.
In microsoft terms:
a workgroup is nothing more than an adminstrative collection of machines with each having its own authentication and access control.
A domain is also an administrative collection of machines but there is centralized security and access control. So you login to the domain as a whole instead of just your local machine. that way your security clearance and access "follow" you around when you access other domain resources like files, printers, applications, mail, etc.
hope that helps...i don't do servers so i'm sure there are more technical answers out there.