In this case a central endpoint security or SIEM solution alerts on Indicators of Compromise on one client workstation in a Windows domain.
Should there be an IT staff who has admin accounts (domain accounts) on these workstations?
Admin logs with domain account in per RDP with NTLM-Authentication (interactive logon type): Dangerous because the credentials are stored in LSASS Memory and are dumpable as ntlm hash from a dump with tools like famous mimikatz, WCE, ...(?)
Admin logs with a domain account using SMB, WMI, WinRM (network logon) (also NTLM-auth, no Kerberos): Is this safe? Microsoft documentation says that there a no credential cached with a network login. An access token is created but with these, if you use token impersonation techniques, you cannot authenticate remotely to another host on network. But the potential attacker on workstation can replay the netntlmv2 hash? So doing a relay attack with tools like inveight, responder, ...
If Admins are part of "Protected User Group", there are only enabled to authenticate with kerberos isn't it? So it would be safe to use RDP AND/OR smb, wmi, etc?
What is the best practice here?
Every time use the LAPS Account for investigation?