Take away his domain admin privileges and instead "delegate" permissions to him by right-clicking the OU. You can also adjust security permissions on each OU and deny that particular user or group access.
There are presently no replies to this message.