I am an AD administrator trying to look at things from an application server owner's perspective.
Imagine a scenario where an AD domain covers authentication in both the corporate LAN and the DMZ. The LAN has RWDC's the DMZ has RODC's, standard firewall sandwich.
The RODC's have been hardened; no accounts are cached, a filtered attribute set (FAS) has been applied, there's a delegated RODC admin account, a firewall is in place, have AV, the servers are patched.
For application servers in the DMZ I can only manage them as much as AD allows me to; I restrict the number of users with admin privileges to the servers, I ensure the firewall is in place, the servers are patched, have AV, maybe there's some account Kerberos restriction.
There are other defences in the DMZ; e.g. the network team have their network firewall, but I can't control that and I can't control what the application owners do outside what I have stated above.
How does the security of the servers in the DMZ look, would they be in good shape? If a server were compromised in the DMZ, what's the blast radius from that; is the domain at threat, are other servers in the DMZ and the LAN at threat?
What would be the most likely escalation path of compromise?
AD: active directory DMZ: demilitarized zone; location for internet facing servers LAN: (internal network; separated from DMZ by firewall RWDC: read/write domain controller RODC: read only domain controller