On a WINS server, the System Operators domain group and the Account Operators domain group have Read and Control rights to the Remote Procedure Call (RPC) service. These domain local groups have Read and Control rights on every domain controller even if the DHCP service or the WINS service does not run on the domain controllers. The System Operators domain group and the Account Operators domain group are very powerful. An account that has Read and Control rights on a domain controller always has the same right on all domain controllers. The only way that you can delegate administration for a WINS server or for a DHCP server is to deploy the WINS service or the DHCP service on a separate server.