Resolved Lock down access rights in a Windows 2008 Domain

I'm running Server 2008 standard Domain in a school where we have emotionally challenged lads.

I have one very IT bright lad who seems to have got hold of an Admin password / logon - could have been by overlooking (most likely) or worse a keystroke logger - although the latter is most unlikely as he is very closely supervised. I know a computer he used it on and firstly want to track down any logon history - it's XP Pro; can I do that somehow?

Secondly, when our kit was set up a few of the staff were given Domain Admin Membership - goodness knows why but they were. Two of them do need access to Active Directory and to student files but otherwise I want to remove their Domain Admin Membership and replace it with a more appropriate Membership.

One member of staff sets up new user accounts if I'm not around the other is a Deputy who probably does need sort of full access in case anything happened to me? Any suggestions please on best practice and the way forward.