An administrator can change any passwd except the
domain administrator's of his domain-site. If there are
more than one sites, administrator of site1 can change
passwd of domain admin of site2, and from domain admin
of site2 can change the passwd of domain admin of site1.
Furthermore, he can import users from other domains and
change the passwords (including domain admins of other
domains).
Cheerss