From what I know, it's a bad practice to login to any workstation or server except domain controllers as a domain admin. I read that mimikatz or other malware can extract the hash of the password from a compromised workstation. What about a regular user logged in with basic user account and when installing software UAC pops up and a domain admin credentials are entered to allow the software installation? Is there a risk in that? Is it also safe for domain admins to RDP into anything but Domain controllers or straight up use RSAT for Windows?
I already have crowdstrike falcon on all the servers and workstations with tamper protection on. I created a local administrators account (without domain admin privileges) to be a member of local administrators group on workstations.
