How can create secure environment with different types of IT administrators?

In my job environment, anyone in need of domain access in an administrative capacity is assigned to the admin's group domain and the access he/she wanted is granted. I have decided to dump such practices and I have decided to remove all those inappropriately accessing the domain under the admin group from that group.

To be certain, I have users who need permission and access to post web pages in to that web servers and with the use of windows authentication, they should smoothly authenticate to SQL and not use SQL users server, etc.

Please suggest how I can implement this and create proper and secure environment with different types of IT administrators.

Any help is appreciated.