We're a small company that is growing pretty fast. For a long time there were 2 of us that were domain administrators. But over the past 2 years this has increased to 6 people and this strikes me as a bad idea as we grow further.
The direct cause of my query is this question. That solution requires that the domain admins that set access rights are fully trustworthy. And that only those trustworthy people can set the policy that restricts setting these access rights to the 2 people.
So, assume we have 2 people that are 100% trustworthy that have full domain admin rights. But these 2 people will rarely be doing the actual domain admin work, just the things we specifically want to restrict to just them.
For a company of 50 - 200 people, is there a common/recommended way to set this up? How best to do this and what rights are generally restricted to the 2 fully trusted people?