Privileged accounts

Administrator accounts are the ones that can change anything, so taking one is rarely a single incident.

An ordinary account gets an attacker what that person could see. An admin account gets them the ability to create more accounts, turn off logging, reach other systems and remove evidence. That concentration of reach is why these accounts need to be treated as a different category: separate from everyday accounts, used only for the task that needs them, and watched. Using your admin account to read email is how one phishing click becomes everything.