Here's what I do:
- I create Domain Admin accounts for each Administrator (that needs one).
- This will be their user name appended with user.name.adm or something like that.
- I bind their email to a normal user account, the *.adm account is only for Domain Admin functions, not surfing the web
- For services that need Domain Admin access (like SCOM), I create seperate accounts and generate extremely complex passwords in keepass. Set it and forget it.
Does this mean that the Administrator account is required for configuring server features and if so what is the best practice for administrator accounts under this circumstance?
Most server features need to be configured as an Administrator, after joining a domain, Domain Administrator will be necessary when making Active Directory changes. MSNLB makes a few changes to AD and other services, but I can't remember where, most likely DNS but there may be other options set on individual containers in AD.
Also, if you've just set up MSNLB pay attention to your ARP requests on your network. MSNLB does not like to play nice with large Layer 2 networks and should be segmented into a separate network. If not it can cause some annoying network problems.