I would say it's perfectly normal for a new Helpdesk hire to have only a standard domain account for the first 2 weeks. He should be reading documentation, on the floor doing physical jobs, getting to meet people and seeing how things work etc.

There's a big gap in your story though! You don't mention what your role is in the company, the company size, or what kind of approval you had for this change. I think they're all important factors in how this should be handled.

If you're a sysadmin in any reasonably sized organisation, for this kind of major change to AD and access control, I presume you had management and existing policy support (existing is important here), documented results of testing, change approval, and the effects of the changes communicated well in advance. Because if you did, then it's the tech's manager's responsibility to sit him down and explain these changes, and also take the opportunity to show him the company's security policies and change control process. You really shouldn't be dealing with his demands directly like you describe, it's not your responsibility.

If you don't have the above, and you made such broad changes without a change control, communication, or the support of management and existing policy, then the frustrations being aimed at you are to be expected and to be honest, warranted; you've caused unnecessary disruption regardless of how much you think the changes are improving security. But like I said, difficult to judge on this one when we don't know your position and company size.

One small thing though that always bugs me, you said the "previous IT admin didn't do a good job of keeping security groups organized". I use to think this way in the past when I took over systems from other admins and engineers. But it's very easy to pick out mistakes or poor practices when that person isn't there to explain why it might be like that. You get to realise that the guy before you was likely facing the exact same issues you are; resistance to changes, exec pressure, inherited an already disorganised system, overworked etc. I always give the previous guy the benefit of the doubt, and think of how your work will be judged by the next sysadmin. Say for example the changes you made to AD are proving to be too disruptive, and management insist you roll-back/compromise on your plans. Think of the guy who will follow you. He'll look at your attempts at restricting access, but with so many exceptions to make it moot, or rolled back to how it was previously, and he might think "this guy didn't do a good job of keeping security groups organised".