Currently in the same boat.  First limit the users who can be domain/enterprise admin.  There should never be too many people with this access.  It is not always needed for regular day-to-day activity.  Next make them have pretty strong passwords or utilize 2-factor authentication.  Log the use of those accounts once they are limited and if you see an over-abundance of log on events, then do some root cause, if it comes up the user is just lazy, well revoke the privs.  One less admin to worry about.

As for the day-to-day AD work, well that can be delegated, again use unique IDs for this.  No one should be using their standard network account to perform the work.  A good way to force them to do this is by making sure their admin account only has access to the services required and can only log on to the servers that host those services.   

For example, the Exchange admin account only needs access to the Exchange box and AD, it should not be allowed to log on interactively to say the database server.

So if you can limit down to unique IDs for things, you can log and alert more accurately, then reduce more if you need to.  There should also be no generic ID used by multiple people.  If an a restriction in an application requires such a thing, make sure it is well documented.