Administrative accounts, local passwords, directory sign-in, emergency access and vendor access: who can do anything, and how to limit it.
A domain administrator who logs on to a workstation leaves the key to the whole directory behind on it. Three tiers, separate accounts and a few user rights in Group Policy close that path without extra software.
The same local administrator password on every workstation built from one image is an open road from the first infected machine to all the others. Windows LAPS fixes this with no extra licences, and a few queries show whether protection covers the whole fleet.
A CI system, a GitOps platform, monitoring and a wiki can all sign users in with a domain account. Direct LDAPS and OIDC through a broker such as Dex or Keycloak give the user the same result and security a completely different one.
The more everything depends on one sign-in point, the more you need access that does not. Cloud-only accounts with FIDO2 keys, a directory account with a split password, an alert on every use and a quarterly test.
A VPN account for a vendor gives them access to the whole network, with no record of what they did, and often for years after the contract ends. A gateway with session recording, time-limited Active Directory accounts and MFA restrict access to specific machines and a specific time window.