A PAW is a "privilged access workstation", i.E. a dedicated, hardened machine just for the purpose of admin tasks. Due to the specialized tasks it needs to run, the workstation can be

- cut off from general purpose Internet etc.,

- a non-mobile device,

- etc....

See for instance Microsoft's documentation: https://docs.microsoft.com/en-us/windows-server/identity/sec...

Pass-the-hash is a common attack on Kerberos - it doesn’t care if you are logged in as an admin or have merely done run-as an admin. See https://microsoft.com/pth for more.

For PAW see https://docs.microsoft.com/en-us/windows-server/identity/sec... conceptually I like to explain it as a client-side bastion host