Question: We're a medium-sized enterprise with many different IT administrators (e.g. domain admins, Azure admins, DB admins, ...). We're worried that hackers can easily breach an admin's laptop and through that steal data / do serious harm. 

We thought about using VDI / jump server so that an admin would connect from his personal laptop to that remote machine and administer the network through that. However, it doesn't seem to really solve the problem as if an attacker owns the admin's personal laptop, he can simply control the remote machine. 
We also read about [Privileged Access Workstations](https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations) (PAW). While the approach seems safer, it's too cumbersome for our users and requires discipline.

What's the best (practical) way to protect IT administrators?

Answer: 
Using a VDI/Jump Server isn't such a terrible idea, it's a pretty common technique - if you set it up with some sort of multi-factor authentication (which isn't on the laptop) then at least a compromised laptop can't just connect into your management network.
I'd separate administartors' less-privileged operational accounts (for day-to-day duties) from more privileged accounts like domain/db admin (which are used during changes in domain/database architecture - a much rarer tasks). 

Yes it could require fine-tuning, custom roles and so on, but during it you'll better understand your RBAC-related landscape.

For most privileged accounts I'd recommend shared passwords (i.e. half of password stored in warbox) combined with 2FA.