In large systems, we recommend creating two separate domains for your company domain and your SAP system domain. Between the two domains you can have trusted relationships which is useful for single sign-on functionality.
In the company domain, you set up your domain users (to include your SAP system users) and your company domain administrator.
In the SAP
domain, you set up your SAP system servers, services and administrators, including:
SAP system application and database servers
SAP system or database services
SAP system administrators
Windows administrators
SAP domain administrator