Steps to secure Active directory pass the hash attack and clear text password

Hi,

I have Microsoft Active directory implemented with windows OS 2012R2 person who don't have Any privilege rights on the server he is able to escalate himself as enterprise admin. I would like to know how to secure this. As per my understanding he is using pass the hash attack and PowerShell exploit.

Nagesh C Samant