Active Directory question

[harvesterofdata]

You need to be a domain administrator. When the workstation is joined to the domain, the domain administrator group is added to the local administrators group.

http://www.windowsecurity.com/articl...elegation.html

I would recommend that you only allow very few people to be domain admins and above. Use delegation when possible. So, you can allow a new admin the ability to reset passwords but not allow them to create accounts or join new workstations to the domain.

actually the user is a domain admin but the problem is he cannot perform admin priviledges like a local admin on the workstation only the domain admin called "administrator" can do this to simplify it:
I opened a user in my domain and called it "admin" then add this admin to the domain admins group after this I logged in into a client machine in the domain with this user called "admin" but I cant install softwares or change the network settings, so this user is not added automaticaly to the local administrators group and I have to add it manualy on each computer.