Secondary AD Admin account

Here’s my question - what’s the use case here? Just to have a backdoor admin account? If so, use the prestage account and LAPS. If it’s for the users to have admin permissions, then why not use the temp admin access via JAMF connect?
 

That account that you’re asking for would be created on the fly at login - just make sure your JAMF connect configurations are set to have the group for the admin account to include admin permissions at login. 

We are Cyber essential compliant, so part of this is for users to have a separate admin account, and not elevate standard. we are wanting to make sure that any user who needs to Elevate will do so on a second account.

Cheers

I get that - but also look where I work. All of our users are admins on their machines. We block east/west traffic. Essential applications (365, JAMF, Active Directory, VMware, etc. etc. ) we have a named admin login for and use delinea to house those creds. 
 

The endpoint that the user is leveraging isn’t the issue if it’s setup properly (including network, firewalls, etc.). 
 

Granted, we are looking to move users back to standard and request elevation when needed. I think AdminByRequest had something similar to what you’re wanting - but it’s been a while since I looked at it.