Protect and Limit Domain Admins
Protected Users Group
Isolate administrative workstations
Secure local administrators, computers and servers
Limit Powershell and enable enhanced feature
Detection and Defense