In our case we run servers and then have thin desktops (using LTSP) that actually log in and run their sessions on the servers. The servers carry our entire password and group file because everyone can log in to them.
In general, in any NFS based environment all machines that NFS-mount common filesystems need to carry a full collection of login and group information so that things like 'ls -l' work on the NFS filesystems. If you want everyone to be able to log into every machine, they also need some sort of password information as well (either by distributing shadow files or by various other means).