Set up Admin By Request on your servers and have it audit all domain admin logons, including software installs. You can also revoke external consultant and help desk admin rights and let them logon to your servers without domain admin rights and have them request administrator rights on a case-by-case basis. Visit Us - https://basic-bytes.com/products/access-director/