Active directory built-in group security

Hi,

We`re currently using Windows 2000 server and active directory. I would like my local administrators to be able to install program on servers (including DC), administer OUs without being on the built-in Administrators group. Indeed, they can add themselves to the “Domain Admin” group.

How can I prevent that?