Sysinternals

Routine Active Directory work does not require an RDP session or an interactive console sign-in on a domain controller. A separate, managed administration workstation is a better place to run the AD tools, inspect objects, make a narrow change, and keep a record of who performed it. That separation matters. Domain controllers hold directory credentials, Kerberos keys, DNS data, and the tools that change the forest. Browsing the web, opening email, or running a general-purpose admin desktop workflow on a DC increases the chance that a workstation-style problem becomes a directory-wide incident. ...

I manage two different types of remote computers every week: Windows hosts that I access through Remote Desktop Protocol (RDP), and Linux hosts that I access through Secure Shell (SSH). Instead of putting every connection into one large application, I use two focused tools: Microsoft Sysinternals RDCMan for Windows RDP connections and Tabby for Linux SSH connections. This arrangement keeps the connection type visible. When I need a Windows desktop, I open RDCMan. When I need a Linux shell, I open Tabby. Both applications are lightweight enough to leave available during the day, and both let me organize a growing list of hosts into named groups. ...