Can CSP or DCS:SA version(s) control adding and deleting members to groups like Domain Admins?
I don't think it can.
http://www.symantec.com/business/support/index?page=content&id=TECH227679