Best practice to stop admins bypassing Password Safe with direct RDP/SSH (on-prem U-Series, multi-VLAN, GPO local admin)

Hi all,

Environment:

• BeyondInsight / Password Safe on-premises, U-Series Appliance, version[26.3.x – confirm build]
• Deployment:[ Active-Passive HA ]
• Managed servers: Windows and Linux, spread across multiple VLANs
• RDP/SSH sessions go through the Password Safe session proxy, with recording and Change Password After Release enabled

Our challenge: Admins can still bypass Password Safe and connect to servers directly with mstsc.exe or PuTTY. Those sessions aren't requested, approved or recorded. Our current setup:

1. GPO adds regular accounts to local Administrators. Restricted Groups / GPP add domain groups containing admins' regular (non-privileged) accounts to the local Administrators group on servers.
2. Servers are spread across multiple VLANs. Admin workstation VLANs can route to server VLANs, and inter-VLAN rules allow TCP 3389/22.
3. Default RDP logon rights. Any member of local Administrators can log on through Remote Desktop.

Questions:

1. Does BeyondTrust have an official recommendation or hardening guide for stopping direct RDP/SSH outside Password Safe in an on-prem U-Series deployment?
2. Is restricting inbound TCP 3389/22 on target servers to only the U-Series appliance IPs (through inter-VLAN ACLs and a Windows Firewall GPO) a supported and recommended approach?
   • In Active-Active or HA setups, which appliance IPs (including worker nodes and the HA partner) need to be allowed so sessions don't break after failover?
   • Are there side effects on password change, discovery, Disabled at Rest or other Password Safe functions if we only restrict 3389/22?
3. For servers across multiple VLANs or segments, is one U-Series appliance (or HA pair) reaching all VLANs the recommended design? Or should we deploy additional appliances or worker nodes per segment?
4. How do you handle the move away from GPO-based local admin membership for regular accounts? Do you use dedicated privileged accounts managed in Password Safe, Disabled at Rest, or a combination?
5. Is there a recommended way to detect bypass attempts, for example alerting on Event ID 4624 Logon Type 10 where the source isn't the U-Series appliance?
6. How do you design break-glass access when the appliance is unavailable?

Any real-world experience, KB articles or reference architectures for on-prem U-Series would be very helpful.

Thanks in advance!