Because administrators have such sweeping power, enterprises will need to limit the number of administrators to a handful of trusted employees, even if the company employs tens of thousands of people, experts agreed. Wells Fargo Bank, which plans to roll out 120,000 Active Directory user accounts, but will create only one administrator account to be used by a staff of 10, said Dustin Sauter, enterprise systems engineer at Wells Fargo. Use of the account will be audited and limited to 10 highly trustworthy people. Administrators will delegate limited authority to the remaining IT staff at Wells Fargo. Those users, for instance, will be able to configure a printer or change user passwords in a small workgroup.
Caution is in order in that scenario, as well.
There will be company XYZ, which places everyone except the receptionist in the admin group. The broad powers of administrators are especially a concern as sensitive business data such as credit cards and banking records are exposed on the Internet or in other e-business applications, and it's also a concern when you consider it in the context of sensitive payroll information, critics said. Microsoft said Active Directory is simply working as designed. Active Directory replaces the current NT domain architecture, where most organizations have many separate domains, a crude precursor to a directory. Allowing organizations to create a single domain spanning the enterprise and giving administrators complete power in that domain will streamline administration, Microsoft maintained.