before you decide to change the domain or workgroup of the account, the account will need to have the Account is sensitive and can't be delegated permission on the appliance-tier server. For more info, see this site within the Microsoft Site: Enabling Delegated Authentication. If the Cons