The Domain Admin credential is used to change passwords for domain credentials, it is necessary because it is a high-privilege change. Credentials that are used to change passwords for other credentials must have greater privilege, otherwise Windows itself will return Invalid Credentials error in LDAPS cases, or WinAuthorizationError in case of RM/RPC.