This may be somewhat OT.   My institution is engaged with a vendor to assist with a migration of AD to a new forest. Part of that engagement is the installation of Quest tools: Change Auditor and Active Administrator. The vendor is saying that the account to run these needs Domain Admin privileges. I have seen vendors be lazy and rather than ask for the explicit rights needed just tend to say, “pop it in Domain Admins.” I am hoping that someone on this list has some experience with these tools and can debunk the notion of needed DA privs on a service account.   Will some with experience with these tools please reply?   Brian Britt