some of our admins wanted to have access to some of our machines, so we put them in the "Domain Admins" group in the AD/DSFW.
But now they see ALL Files of ALL users in their share. It is as if they are THE admin user in edirectory.

How can we prevent this?
They should not be able to see everything.

System: sles10sp4 + oes2sp3
2 dsfw servers
many w2k8r2 servers