Fwiw, if someone told me to start from scratch to secure a Windows fleet, I'd actually probably avoid AD all together. Manage all machines through a config MGMT tool and just set local policies. At least in my little world, the need to auth to apps via AD is essentially dead and AD would actually be way more overhead and attack surface. An interesting thought experiment though!