List of all rights and privileges assigned to Domain Admins

we run active directory @ windows 2008r2 functional level 2008r2 dcs. have inordinate number of domain admins right , we're beginning process of reducing number. ad sys admin, i've been tasked delineating of rights , privileges come being domain admin (member of domain admins security group). approach makes sense management perspective, since can take list of rights people have dom admin rights not familiar active directory , ask them line line "do need this?" goal being when "no" item on list, can use leverage revoke dom admin rights , create more appropriately delegated security groups. 

here's rub. pretty  much have ever read on ad gives me version of "domain admins can everything" without quantifying "everything" includes.

at least, need list of things in environment have access to. here's can think of off top of head:
local admin on domain-joined computers (includes own list of rights)
admin access file shares on network
remote desktop access domain-joined computers
active directory users , computers
ad sites , services
ad domains , trusts
dhcp administration
dns administration
group policy
dfs administration
event logs on domain-joined computers

things dom admin can't do:
update schema (schema admins)
administration on other domains in forest (enterprise admins)

what else go on list? or can find information in concise format suitable task? if can't broken down simple list, i'm pretty left handing boss 500 page textbook on ad administration , saying "this dom admins can do" - doesn't accomplish our goal.

i'm not aware of lists of these items published in technet, although there may security-best-practise white-papers kicking around.
edit: https://technet.microsoft.com/en-us/library/cc750076.aspx

your initial list start, had these further thoughts you;

ad-permissions:
create/delete ad leaf objects (users, groups, workstation-computers, server-computers)
modify attributes of ad leaf objects (eg user object details phone, address)
ad services (sites, subnets, scps, trusts, etc)
gp admins (including central store admin)

not-ad-permissions:
exchange objects (mailboxes, smtp addresses, etc)
dfs admin

member computer admin rights (eg administer workstations including rejoin domain, remote control, remote-manage, access logs, access volumes on workstations)

dns admin

dhcp admin

member server admin (not dc's)

although can use gp add users/groups member-computer localadmins group - that's not ad permissions, since ad can't grant permissions facility on membercomputer, that's controlled member-computer.

it's subtle important difference.

in organisation, need account location/site or departmental boundaries? if so, mean need consider permissions/privileges applicable location/site/departmental boundaries, , duplicate groups/permissions relevant site/location/departmental scope.

---

don
(please take moment "vote helpful" and/or "mark answer", applicable.
helps community, keeps forums tidy, , recognises useful contributions. thanks!)

Windows Server  >  Directory Services