Our sysadmins handle a multitude of tasks on servers and workstations alike. I would like them to be able to administer all servers and roles (DNS, DHCP, Remote Desktop Services) with the exception of changing group membership of domain administrator accounts, and taking ownership of files and folders on our file server. (I don't want them elevating their own accounts).
I've been looking into making them members of the Server Operators group, but I can't seem to find information on whether or not this would provide too much privilege. The other thought was to make them local administrators of the member servers, but this would allow them to change permissions on our file server. (I suppose I could exempt this group from this server).
This is my though process so far:
To manage workstations: Make the sysadmins members of the local administrators group.
To manage servers: Add sysadmins to the following builtin server groups: DnsAdmins Event Log Readers Network Configuration Operators Performance Monitor Users Print Operators Remote Desktop Users
On a side note, Sysadmins would also be members of a 3rd group with delegated access to manage user and computer accounts, and reset passwords.
I appreciate any thoughts, clarification or suggestions.