Help-desk staff should restart one approved service remotely without receiving full administrator capabilities. What should be evaluated?

1. Permanent membership in Domain Admins
2. Disabling all remote-management auditing
3. Just Enough Administration with a constrained role capability
4. An unrestricted shared administrator session