[Samba] best practice for domain admins

[Stefan G. Weichinger]

I expect the next "you should know" here.

How do you handle administrative accounts in your samba/windows domains?

I have to provide some accounts for the so-called admin users at the
customer ... in some cases they learned the main admin pwd (yes, bad)
and used it for installing this and that.

Add their own users to group "domain admins"?

I'd like to take away the main admin pwd from them. I have to.