With almost all ports blocked on the domain, there is no way for intruder to remotely access domain controller and do big changes to the domain. Can anyone enlighten me on why a lot of resources are still put into protecting domain admin accounts and how much possible harm can an intruder do with domain admin account without access to DC?
Maybe this will help:
You said: "With almost all ports blocked on the domain, there is no way for intruder to remotely access domain controller and do big changes to the domain."
All ports blocked? inbound or outbound? This is the idea behind rats/backdoors.
If a domain admin can control any system, they can disable a system from domain restrictions if they wanted to. Leaving them more vulnerable than you'd expect (a monitoring note). If they domain admin wanted access to the domain controller, they'd pretty much just need to backdoor or monitor a user who does have access. They can launch exploits that may require admin privs locally to exploit. Fileshare and vm escapes sell for some good monies these days. I mean, there's a whole world of possibilities. If your single point of failure is your DC, you might want to think about the platform your DC is on. Most people, it's on windows, with other services, on a shitty physical box or virtual instance. If it's in a virtual instance, that's probably within a whole other realm. People have found attackers using dns, http, smtp, irc, xmpp, smb, nss, slack web api, other web api, etc... to pull data about your enterprise out depending on abilities of your network. Some attackers have dozens of malware generators just for these types of network and will rotate between sample structures until something else works (often from phishing).
So, to answer the question, your enterprise is at stake. You don't need domain controller access, which an intruder would have better leverage to attack at with domain admin creds, to own an entire company. That hasn't been thought of as needed or required for many years. The claim that ports being blocked doesn't really change that.
If your entire network has no external access, PoC campaigns have shown that this doesn't really stop someone dedicated to taking your company.
Soo.... The reason why people put so much effort into it is because it's a baseline monitoring requirement if nothing else to attempt to protect administrative accounts that can compromise any system in your enterprise.