In addition to the Common Criteria roles, Windows Server 2008 can implement other roles in the PKI management structure, which are discussed in this section.
The CA’s local administrator is any member of the local Administrators group in the local accounts database of the CA computer. This typically includes the local Administrator account and the Domain Admins global group from the CA computer’s domain. The membership can also contain the Enterprise Admins group from the forest root domain.
A local administrator can perform the following tasks at a Windows Server 2008 CA:
All CA administrator tasks. By default, the local Administrators group is assigned the Manage CA permission.
All certificate manager ...