Remote administration

Remote administrative access is the single most useful thing an attacker can find, because it is the thing built to control everything.

It is also indispensable, so the answer is not removing it but constraining it: restricted sources, strong authentication, its own logging, and separate from ordinary user access. Any tool that grants it, including the ones bought for IT support, belongs in the same category as domain administrator.