The one group that has global control over all users, groups, and computers in a single domain is the Domain Admins group.

该组可以全权管理单独域中的所有用户、组以及电脑。