Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our team does not use the admin accounts (there are no anonymous admin accounts, each administrator has a designated admin account) during normal operations. Only when needed to make a change, perform maintenance etc and for off-site support we have two-factor authentication. Small companies where you have to be multi-talented, overworked and underpaid is what I am getting at :)
We recently went through an audit where there was a request for us to limit/disable the concurrent logins for admin accounts. The general idea is: how do we make it hard for a rogue admin to be malicious, and also how do we know that the logged in admin accounts are not compromised (hacker logged in with admin).
From my research there is no way to limit the concurrent logins for an account on a Windows domain out of the box? Does it require third party software?