Networking → Re: Odd issue has been happening/question at end.

for example, everyone of us has admin access to the AD, DHCP server, Group Policies, domain server, exchange server, sharepoint server, etc. etc.
And from what I understand, that's pretty odd.

The thing is no one does anything without communicating it first to everyone else. And then one person will take care of it. And that is usually an IT admin or the director.

An domain admin account gets the malware, it can infect the entire workstation and all the other computers too, at the admin level.. RAT, keyloggers..

And if an Enterprise Admin gets hit then the whole forest is vulnerable.
(though if it's a single domain forest it doesn't make much difference from domain to enterprise admin, though there would still be a few things a domain admin can't do that an Enterprise admin can.)

Then there's Schema Admin, that one is rarely needed so the best practice is as a domain admin only grant it to yourself when really needed. (IE schema prep or custom Schema extensions.) Sure a Domain or Enterprise admin can grant it to them selves, but some of the things that only a Schema admin can do must also be done on the Schema Master and that can mean waiting on AD replication after granting the group membership.

BTW for the most secure AD forests you wouldn't use any of the built in Admin groups.
I've read some white papers on it, and honestly doing what they suggest is a PITA.
But those whitepapers suggest creating more granular admin groups, and getting to the admin structure they suggest requires some deep AD modification.