While I primarily work with penetration testing for my company (A small/medium sized company with approx 50 employees), I'm also a part time member of their sys-admins team (it's handy to keep up-to date with server environments/networks etc). There is one manager in a remote office who "knows what is best" and always "wants to get things done now". The MD has given him approval to have a domain admin account but I'm not sure they realise what the implication of that is.
The manager is not particularly technical and has a fairly rudimentary understanding of IT. Nonetheless, we find him making changes to our environment (resetting passwords, installing new software/applications/servers) and dictating directions (choosing hardware etc) for us. I'm pretty tired of it, and I'd like to present a list of compelling reasons why this shouldn't be allowed.
Primarily we are a security company so as a result, I'd like to focus on the security side of things (that's where my expertise lays so it carries the most weight if I speak to the 'higher ups') but any business reasons would be good to have as well.
Okay. So maybe I'm a bit unique in that I personally care if something goes wrong in our environment. I'm personally quite fond of the work I do and the company I work for. But since we are a fairly small company, most people are somewhat involved. If something goes wrong I'm covered, but there will still be fall-out of some kind which would impact the business.