IIRC, you can't log onto a domain controller unless you're a domain admin. And you do not want to give that priveledge away lightly.