This message was deleted.

Put some endpoint MFA on the servers? Use a PIM tool like CyberArk? Restrict the IP ranges that can connect? Use FSLogix to hide the consoles from everyone except members of a certain group? Use AppLocker to restrict execution to certain groups?

All good ideas, thank you! There will be IP restrictions in place but I'll look into all the other options as extras!