Linuxsucks

Everything you described is possible using sudo, when configured as desired.

Everything you've described is NOT default configuration in Citrix or Windows. I.e. removing local administrative accounts, domain admin accounts with limited permissions and rotating automatically resetting passwords, etc.

I've worked for several enterprises that require UAC password for elevation every time it's needed as the person with elevated permissions (someone who's smarter than the average user) isn't expected to write down their passwords in accessible spaces.

Most enterprises are using third party products to manage the same structure you've described.

You're describing how a lot of enterprises are managing authentication when handled by a person. Not out of the box configuration.

Again, it's a situation that is customized to the usage scenario. What people have suggested you do with your Linux systems.

As noted previously you can configure sudo as desired by the enterprise.