There are dozens of servers and hundreds of workstations, and each of those is in the hands of a person who just wants to get work done. This area covers keeping endpoints in a predictable state: splitting responsibility between Group Policy and management tools, updates, image standardisation, and working outside the corporate network.
The same local administrator password on every workstation built from one image is an open road from the first infected machine to all the others. Windows LAPS fixes this with no extra licences, and a few queries show whether protection covers the whole fleet.
An update installed on every machine on the same day breaks something on every machine at once. How to build four rings from Windows Update for Business policies, set enforcement deadlines and check who has fallen behind.
Group Policy and an endpoint management tool can set the same values, and when they do it at the same time the workstation flips between them. A responsibility map, the mechanics of the conflict and a clean-up of Group Policy Objects.
A workstation prepared by hand is unique, and when it fails someone spends a day rebuilding it from memory. How to split a workstation into layers with their own sources and check that none of them lives only on the disk.