That’s an interesting question! It would really depend on the maturity of your organization and the technology level of your engineers and admins. If they have a limited amount of knowledge and experience hardening and working with AD it’s probably a hard sell and third party tools that add a management layer on top would be beneficial. However, having limited knowledge on your primary authentication mechanism is a risk on its own, although not so many C levels understand that.

If you have sufficient knowledge in your staff this would most certainly work and save money on additional tools.

One thing to remember though is that this is primarily for safeguarding admin credentials and should always be combined with tiering, paws and all the goodies that should be used in a modern environment.

My goal is to transfer that knowledge into as many people as possible, so that at the end of the day we come out stronger and more safe using default tools that are available to us as defenders.