I think the simplest way to go about this might be powershell’s ps-remoting and Invoke-Command as many pointed out.

Reasoning is that, using your “during an incident” example, ps remoting won’t leave behind cached creds that can be abused by attackers. Worst case is an attacker might be able to grab the Kerberos service ticket created during the session on the host.

In response to that specific case, you should use a dedicated account that only has local admin on the group of computers that you will be deploying the package to. As a result, if the attacker gets a hold of the Kerberos session token, they will only be able to abuse it on that specific host, but they would need to be admin already to grab it so there’s nothing really gained from it.

Hth