I'd like to know what people consider best practice for securing the Admin sections of websites, specifically from an authentication/access point of view.

Of course there are obvious things, such as using SSL and logging all access, but I'm wondering just where above these basic steps people consider the bar to be set.

For example:

• Are you just relying on the same authentication mechanism that you use for normal users? If not, what?
• Are you running the Admin section in the same 'application domain'?
• What steps do you take to make the admin section undiscovered? (or do you reject the while 'obscurity' thing)