In one of the client, I have to deal with one of the big things. There are some SVC accounts in administrator group of the domain. The thing is that I need to remove them from the group and instead assign appropriate delegation. The problem is not so many ppl know what will break if we remove them. And we can't just remove the SVC from the group and wait to see who will call. Do you have faced a similair task like this?
What do you propose if you were on this task? I was thinking about checking the logs on DCs but the problem is, the environment is huge containing 100+ DCs and logs are regularly over written. Any tips in total?