The Active Directory tiering model, applied for real
Everyone knows the tiering model; few apply it. Its principle fits in one sentence, and its implementation stumbles on defining the real Tier 0. Here is a pragmatic, step-by-step approach.
A simple idea
The tiering model starts from one observation: an account that administers a critical asset must never be exposed on a less secure one. If a domain admin signs in to a compromised workstation, their credentials or Kerberos ticket stay in memory, ready to be harvested. Tiering organizes the estate into levels and forbids those downward logons.
The three tiers
- Tier 0: whatever controls identity. Domain controllers, the Active Directory forest, the AD CS certificate authority, the Entra Connect server, ADFS — and everything that can modify them: hypervisors and backup consoles that host or restore domain controllers, deployment tools that install agents on them.
- Tier 1: enterprise servers and applications.
- Tier 2: workstations and users.
Microsoft has since evolved its guidance into the Enterprise Access Model, which extends these principles to the cloud. The core is unchanged: define the control plane and never let it depend on a lower tier.
Tier 0 is always bigger than you think
The first step, and the most revealing one, is inventorying the real Tier 0. There are almost always surprises: a monitoring server whose service account is a domain admin, a backup console able to restore a domain controller, an inventory tool installed on the DCs, delegations on the domain root granted to a helpdesk group. Anything that can take control of Tier 0 is Tier 0.
Concrete measures
- Separate accounts per tier: every administrator has an office account and a dedicated admin account, never used for email or browsing.
- Privileged access workstations (PAWs) for Tier 0: hardened, no email or browsing, the only machines allowed to connect to domain controllers.
- Logon restrictions via GPO: Tier 0 accounts are denied logon on lower-tier servers and workstations.
- Kerberos authentication policies and silos to bind privileged accounts to their admin workstations.
- The Protected Users group for admin accounts: no NTLM, no delegation, no credential caching.
Start small. Isolating domain admins and domain controllers first delivers most of the benefit. Tier 1 can follow.
What an audit measures
A tool-based audit exposes violations of the model: privileged accounts that signed in to lower-tier machines, attack paths from a user group to a Tier 0 object, service accounts in admin groups, excessive delegations on sensitive objects. Every path removed concretely reduces the attack surface — a far more meaningful progress indicator than a compliance percentage.