Let me see if I understand your question. You want to enter the live, admin password into an automated tool? And you are unclear on the risks of doing that?
A few things come to mind:
- the distribution and storage of the live admin password across multiple "users"
- the sharing of an admin password for multiple purposes
- the lack of positive attribution of any actions performed to the scanner or the admin
- the inability to easily disable the admin password if the scanning tool is compromised
- the inability to lock out the scanner's credentials outside of expected scanning windows
- the inability to limit the scope of the scanning admin account
- the violation of "principle of least privilege" and "separation of duties"
- the various compliance issues that might arise
The scanning account needs to be distinct to each scanner so that its effects can be limited, the actions of the scanner can be properly attributed, and the credentials can be disabled if compromised.
No one should know the system/domain admin password but the admin...