Security template for NT/2000

Anyone know where i can get a template or white paper detailing the privileges in NT/Win 2000 User Mgr.

I want to re-structure our user privileges, i.e. who is in domain admins and who can do what but i'd like to look at something which sets out exactly what each account can do.

Also does anyone know if microsoft or anyone else has a template for allocating people into groups & who should have what privileges?

Thanks in anticipation