I think the domain controller Administrator has to be a member of the Domain Admin Group...has it been removed??

Also...what changed

someone tweaking the network security...any policy changes recently??

MLF