Separate administrator accounts from person accounts [CPG two.E]. Only allow specified admin accounts to be used for admin reasons. If an individual consumer requires administrative rights over their workstation, use a independent account that does not have administrative usage of other hosts, for instance servers. This Original match is made us