We've gone through a process of removing all our site reps from the Domain Administrators group. The main issue for this was a security requirement to not allow them to have too much power. No sense in having them break anything on our servers to test our DR recovery capabilities. Read more