Some security questions

[anything I don't mind]

Is it bad practice to use the domain administrator account as a user account ie make it email enabled and have a user actually monitor the account and login in to a client pc with it?

How often do you change domain admin passwords ? I work at a few sites and the one site is terrible. I have been there for 18 months and they won't change the domain admin passwords "in case something happens". Which is ridiculous. they have all the passwords in a xls file with a simple password and i exported and imported it all in to keepass and set it up on all IT pcs with a keyfile and password. The other IT guys won't allow me to delete the sheets in the xls file. They say that they will have to update documentation, i said will do that then. The guy will seriously argue with me about it and get pretty annoyed etc. I am half tempted to just do it but i know he will go as far as recreating it etc. How can i talk sense in to these sorts of people and implement basic security ?

 

[anything I don't mind]

As i have worked there for 18 months I know which accounts are used for service accounts and which ones are not.

I have even changed the system administrator and administrator accounts and see what broke and changed it back. The only problem there was the prtg was set up to use the sysadmin account as a service account to access servers. So the server monitoring software sends alerts. But i just changed that to another actual service account.