Granular permissions for Hyper-V, Domain Controllers and Active Directory

[The_Librarian]

Hello All

I need some pointers on the following.

I'm preparing a Hyper-V replicated solution for a remote site in Zambia.

But this time I want to restrict access to Hyper-V and Domain Controllers as we have issues at our previous site installation, which I still need to sort out.

Basically, I want to create three admins :

*admin0
*admin1
*admin2

Admin0 have full access to everywhere. They can start up, shutdown, create, delete, backup (and lots of others) VM's from Hyper-V manager. And they also have full login access to both domain controllers (primary and backup).

Admin1 have access to only the domain controllers and login access to VM's, they can add/remove users and join/remove computers.

Admi2 have only login access to the VM's, but they can also add/remove users and join/remove computers.

Will this be possible with Server2016? I have a sneaky suspicion I have to use GPO, but want to poll you guys before I embark on something totally new.

Regards

Ook

edit : original administrator account will remain, but will have a strong password, and will be used only for emergencies.