Prevent NT4 Domain Admin group accessing a W2K3 server

Hi,
I’m having a debate with a security colleague of mine and hope you can help?

The security guy reckons that I cannot prevent the NT4 domain admin group members from accessing a WIndows 2003 server that is added to the NT4 domain and I disagree?

Am I going mad?

Thanks
Scchplendid