One not-so-obscure problem is how hard it is to only elevate yourself to admin when you need it (and run as a regular user the other time).

Essentially you need to pay double license for admin users so they can have two logins; and it's a pain to quickly elevate privilege to do day to day admin tasks.

So if your friendly domain admin clicks the wrong link, your entire network is owned.