Windows admins, how do you separate your privileges?

Here's our setup: 1 domain. All of our machines, be they web servers, database servers, desktops, or whatever are all in the one domain.

We separate our admin privileges by server "role". So my admin account for "core services" is packysauce_core_srv and is part of the core_srv_admin group, which is then added to local admins of "core services" machines. My "helpdesky" account is packysauce_dsk and is a local admin on workstations. All of these accounts are smartcard-only, bring the total number of certs on my smartcard to about 15 or 20.

This method of privilege separation was prompted after some hash replay attacks got a bit further than they should. I just want to hear a bit about this topic discussed and find out whats the best way/did we reinvent the wheel/what's cleaner.