Am looking into mitigations to Pass+the-Hash and Pass-the-Ticket in Active Directory that also improve overall network security, too. Have sorting through some of the many two+factor authentication options to increase security of user login, but just discovered that under the standard AD way of doing things two-factor authentication is still using Kerberos or NTLM. So pass-the-hash or pass-the-ticket attacks are still effective against the domain. The stuff I've read seems to say that only "interactive" logins are not vulnerable to this.
How can I adopt two-factor authentication for AD user logins in ways that won't just be as vulnerable to pass-the-hash/ticket as passwords are? To the extent it matters, I'm referring to environments using Windows Server 2008 R2 and Server 2012.