
Some products need to have schema modifications in the domain – e.g.

There should be NO third party tools installed on a DC except by the Domain Admin after careful analysis to determine whether they need to be there.Īnswer, always, is “no”, except for system monitoring tools.

There is no reason for ANYONE who is not a domain admin to RDP onto a DC in an enterprise where there are any other admins who are not Domain Admins.
