Domain Controller Scheduled Task

Hello

What is security best practice for running scheduled tasks against a DC?  Should I run on the DC and should I use a gMSA?  Would it be more secure to create a JEA endpoint and schedule a task on another secure server using gMSA?

Requirement is to report on domain controller backup success / failure using Windows Server Backup.

Thanks