I'm one of the guys who prefers a AD-Implementation with the lowest rights possible - e.g. do not use build in groups if not necessary (the least one necessary in my eyes is Account Operators - usually you design OUs which are supposed to contain users, groups or computers, however AOs would be able to add users to the computers OU - necessary??).
Besides not assigning any members to those groups (if not necessary - again) I prefer not to have any unnecessary rights set on the objects in Active Directory. Every object you create in Active Directory has it's default rights, which are "inherited*" from the schema (*not 100% correct - but either you know what I mean or don't worry). It is possible to modify the default rights in the Active Directory Schema, but there's no guide out there which specifies the minimum rights needed on each object to keep Active Directory and all MS-Applications happy.
I was talking to a couple folks at MS and requesting a guide like that. Last night I was promised that they'll publish a X-Mas present for me. I'm very excited and looking forward to getting this guide - I've been waiting quite some time for it.