actually I'm not looking to minimize the "domain admin"

 

I need to limit the access to the actual "ADMIN" users

 

I need to let someone have access to all users and domains.

but I don't wan them to be able to shutdown the server.or modify any global configs..

pretty much change passwords, add subtract users

 

is that possible?