I have a requirement to force MFA for all non-console administrative access to our Windows AD servers. I've sorted out log ins with RSA, but that does not prevent a domain admin from mapping a drive or connecting via \servername\share and making changes that way.
This is the PCI MFA requirement 8.3.1, for those that are familiar with PCI. I've been beating my head against a wall over this for months; I've grilled Windows admins, googled until my fingers bled, and asked for input from several QSAs. None have been able to pose even a potential solution.
Any thoughts, suggestions, or directions to look would be greatly appreciated. I'm stuck.