The administration of Active Directory SHOULD be limited to dedicated administration systems. These SHOULD be subject to particularly strong hardening based on their limited tasks.
Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)