* User1 - Yes
Enterprise admins in a forest can sign in locally on a new child domain's first domain controller by default, because the Enterprise Admins group is automatically a member of the Administrators group in every domain within the forest.
* User2 - No
A regular domain user cannot log in locally to the first domain controller of a child domain by default, but it is possible with a proper forest trust configuration. Authentication across domains in a forest relies on trust relationships, and a user needs the correct permissions to be allowed to log on locally to another domain's domain controller.
* User3 - No
A user who is a member of the local Administrators group of a domain controller cannot sign in locally. Once a server is promoted to a domain controller, it does not have a local administrator account anymore; instead, the "local" administrator is the domain's domain-local "Administrators" group, which is populated with domain accounts. The user can sign in to the domain controller if their domain account is a member of that domain-local Administrators group.
* User4 -No
See User3.
Reference:
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security- groups