Could you expand on this? we have a similar set up for our domain admin accounts and I heard it was the safest way to do things. What do you mean by PAW?

A PAW is a "privilged access workstation", i.E. a dedicated, hardened machine just for the purpose of admin tasks. Due to the specialized tasks it needs to run, the workstation can be

- cut off from general purpose Internet etc.,

- a non-mobile device,

- etc....

See for instance Microsoft's documentation: https://docs.microsoft.com/en-us/windows-server/identity/sec...

Pass-the-hash is a common attack on Kerberos - it doesn’t care if you are logged in as an admin or have merely done run-as an admin. See https://microsoft.com/pth for more.

For PAW see https://docs.microsoft.com/en-us/windows-server/identity/sec... conceptually I like to explain it as a client-side bastion host