Watching a video series about Active Directory and doing security based on tiers. You have the main administrators in Tier-0 and End users in Tier-2 for example sakes.
The idea is administrator level users never have access to anything but tier-0 to avoid token compromises ect.. You also avoid generic accounts for audit purposes.
My question is this. You are an administrator and you work heavily in Tier-0, but you also work in Tier-2 where you access the internet, emails and remote into other Tier-2 machines for remote desktop work. Do you generally create another account for Tier-0 work or assign yourself privileges do that level on a need to use basis?