Global Administrators Group
For non-hybrid environments that use Domain Services it would help to have a default global administrators group that new user accounts can be added to for new administrators which allows these users to make changes within Active Directory and to Group Policies without having to edit permissions or delegate control over OU's.
Mike Stephens commented
Most of this already exist. But I need to check on the Group Policy part. We had an issue with that, but I believe we resolved it. Stay tuned.
Senior Program Manager
IAM Core | Domain Services