The new way is local account with synced password and Kerberos.