What is the reasoning behind having a master service account with domain admin rights? Could a file exclude entry be added into the GPO for services/registry with elevated rights to accomplish the same thing? My AD Admin want's to try and find an alternate solution without giving out the keys to the house for the domain. Any information is appreciated.
