Due to the power of the DA group it is not always recommend to give DA to random users.

BUILTIN\Administrators is the group you want to put them in.

It goes back to the good and effective security by obscurity, the user thinks: "Hey, I have global administrator rights, I will go mad with power and abuse it." Whereas using the BUILTIN\Administrators they think: "Ah, the sysadmin gave me only the built in administrator on the local machine, I will go slightly less mad with power and abuse it less"

As always, I hope you find some nuggets of assistance in this post. And remember, never ever let good enough get in the way of being perfect.