Hardening domain controllers: tiered administration, Protected Users, privileged access workstations, restricting who can log on to DCs

Domain controllers hold every account's password hash, so whoever controls a DC controls the domain. Hardening DCs is less about one setting and more about keeping powerful credentials away from places where they can be stolen. The exam expects you to know four ideas: tiered administration, the Protected Users group, privileged access workstations and logon restrictions.