This is not difficult, not anything deep, but I feel that if there is no experience in work, sometimes I don't know how to do it well, it is actually very simple, you need to add users to the Domain Admins group. Such permissions are a bit big, you can establish OU to maintain group policies to further limit users' permissions.
