Security account on servers?

Good question. I always recommend that you create a security group and assign that group the permissions that are required (most of the applications require local administrator-level privileges).

Create your domain security accounts and place them in the security group with permissions. Then create a GPO which limits membership in the Restricted Security Group.

Pretty good article here telling you how to accomplish that with Active Directory's GPO:

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html