Admin account best practice

[albedoConsulting]

In the past my old office has set up a Local Administrator account that uses the same password as the Domain Administrator account, so that when logged in as Local Administrator, both for automated installs and for maintainance later, the login has full access to the network.

That has worked somewhat well, though I would like to have some sort of Maintainence account on the domain, with roaming profile, so I can log on and have the settings I want.

However, I am wondering what everyone considers Best Practice here?

* Same password for Local and Domain Admins?

* Seperate passwords? (and if so, what do you do to make software installs work?)

* Disable Local Administrator

* Some sort of Installs Domain User, or login as Local Admin for that?

NOTE: We are doing a CD based automated install, rather than booting from the network, SMS, RIS, etc. Also, this is for a 30 person office, with relatively minimal security issues. Suggestions based on what 500 person Fortune500 companies with $billions in stealable info is not necessary. More of a Small Business Best Practice.

I have done a search, and seen suggestions on HOW to implament different approaches, but not suggestions on which approach to use and WHY. Any suggestions would be very helpful.

Best,

Gordon