Attended sessions keep users in the loop and reduce the chance of unauthorized changes; unattended agents can save time but widen blast radius if credentials leak.
MFA on admin consoles, IP allowlists where practical, and separate break-glass accounts reduce abuse scenarios.
Policies beat improvised shortcuts: who approves installs, who can request elevated rights, and how remote sessions are logged.