I seem to remember the "domain admin" gotcha when I did our BES - turned out that Printer Admins were included in this "definition" - so all Blackberry users had to have their printer rights taken away