Microsoft does exactly that, they're called Secure Access Workstations, and they're used for all sensitive work. You can find some details here: https://docs.mi

Microsoft does exactly that, they're called Secure Access Workstations, and they're used for all sensitive work. You can find some details here: https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations#how-microsoft-is-using-administrative-workstations https://docs.microsoft.com/en-us/windows-server/identity/sec... They're described as PAWs in the document, but they are called SAWs internally (as one of the notes explains down the page).