Recently I tested Domain Trusts\VPNs on my virtual lab and at one point I wanted to add a user as Local Admin on Domain Controller. Idea was pretty thoughtless since there is no Local Users Group on DC. Once you promote server to DC, there is no way to define Local Admin on it.
