How do you disable an OU from resetting domain admin passwords?

[After Burner]

In my Active Directory environment, I have an OU of standard users I need to restrict their permissions from being able to add themselves to domain admin members group, reset/change domain admin passwords, create/disable domain admin accounts. How do you do this?

Continue reading...