How to protect against an attack from a computer inside Active Directory domain?

Question

I have 2 AD domains that are joined into a single AD farm with two-way trust. One domain is used for production servers that nobody has access to, and the second domain host