Creating a group in the domain containing the domain accounts that are allowed to administer machines, and adding that domain group name to the local administrators group on each machine, let you ...