Rookie mistake. The password is what we write on a sticky note and tape to the edge of our screen.

Birthright membership in the Domain Admins group is what keeps all our users from being pestered when they want to install that neat new tool they found. Then you don’t need to harden the built in admin account against attacks, you can just disable it!