The scenario is:
There are two domains (DomA and DomB) with a trust relationship. The relationship is forest wide with the exception that DomA can access resources in DomB, but users in DomB should not have access to DomA.
In Domain A, there are default groups: Domain Admins and Enterprise Admins. The Domain Admins should only be admins in DomA, not DomB. Enterprise Admins will be administrators in both domains. The problem about Enterprise Admins is solved by adding the DomA Enterprise Admins group to the built-in Administrators group in DomB, so users in this group can administer Domain B from Domain A with no problem. But there is one BIG security hole here:
Domain A Domain Admins can add themselves to the Domain A Enterprise Admins group and become admins of domain B too.
Is there a way to secure those things somehow?