Set up a local root user on every box. I highly recommend not
relying
on LDAP for that, or you're a bit screwed if, for example, your network
cable goes bad.
Right, I just made my AllowGroups line look like this:
AllowGroups root operations
AllowUsers appears to trump AllowGroups so this is a good solution.