Having worked in both Public and Private sectors as an Info Sec guy I have had the opportunity to see how many organisations approach this and here are some of my observations;
Do you require/support Smart Card Authentication?
I have yet to find an organisation that has deployed smart card auth.
Restrict logins from a particular workstation?
This should be a basic building block, but many sites still fail to restrict access in this way. Further to this, specific accounts that require admin privileges should also be restricted to the specific servers / workstations required. Overly permissive rights can lead to domain compromise.
Require more complex passwords for Administrator accounts?
One site had a fantastic approach to this, they used a long pass phrase for the admin accounts. This served two aims. One - It protected against brute force attacks (who is going to have a dictionary or hash table for a fifteen word sentence?) and secondly it was used to stop the support team from giving the password out on the phone, as it would be obvious they were doing so. That team had a long history of passing out the admin passwords to stop them from having to leave their office and visiting users!
The use of a different computer, or VM for administrative tasks
The use of a management VLAN or other segregation is a good approach. Taking sensitive traffic and access away from the corporate lan is a start.
You should also have an approach to address the use and update to management tools. Deprecated management tools can lead to full domain compromise and a prolific on internal networks. How many times have you thought to patch your 'HP Management Service' or even turn it off? How many remote connection tools do your support team need? I have been on site where Terminal Services / VNC / DameWare and other remote tools were all in use on the same network for the same servers!
So take away here would be to review your approach to the use of management tools, disable those you don't need, reduce overlap of tools used to complete the same task and patch those you choose to maintain.