In 2.1 version of firebird domain admins had full access to user management functions (exactly like to all other databases). In 2.5 one must use ALTER ROLE operator to enable sysdba-like access to any database being connected to that database. That's OK, but it's impossible to directly attach security database, except embedded case (missing with super). Therefore granting user management functions to domain admins using only firebird tools is impossible on SS, which breaks cpmpatibility with FB2.1.
To fix it appropriate gsec switch and services support should be added.