It seems to me that the admin user MUST be a trusted user. You need to set up users/roles for everyone else to access only the portion of the systems and rights you wish them to have. But, just like a system admin for a windows XP network, there is an admin that has access to ALL data on the system. It is impossible to lock them out, nor would you want to. If there is a problem, you would want an admin to be able to fix the problem.
Several years ago I worked for a company that had a finance/payroll system that was programmed in-house. That meant that the programmer had access to sensitive information about payroll. For the most part everyone was oblivious, but one day it came to light with managment. There was a huge issue made of it, that he cannot have access to the sensitive information. Well, it was impossible for him to do his job and maintain the system otherwise. The only solution at the time was for hime to become a trusted source, or they needed to hire a programmer that would be.
So, the only way to handle this situation is only a trusted source has the admin password, Just like the admin of the network has access to all network files.
All other users you place in a box and remove security rights.
