Securing Privileged Accounts (Tiered Admin Model)

The tiered administration model is Microsoft's recommended defense against credential theft and lateral movement in Active Directory, built around the observation that if a highly privileged Domain Admin account ever logs onto a compromised or lower-trust machine, an attacker who owns that machine can harvest the credential and escalate straight to full domain control. The model splits the environment into three tiers — Tier 0 (domain controllers, AD FS servers, Entra Connect, PKI, and anything that can directly control the identity store), Tier 1 (member servers and applications), and Tier 2 (user workstations and help-desk-level support) — and enforces that credentials from a higher tier are never entered on a lower tier's machines.

Enforcing this separation in practice means an administrator holds separate accounts per tier — a Tier 0 admin account, a Tier 1 admin account, and a standard Tier 2 user account for email and browsing — rather than using one all-powerful account everywhere, since a single account used across tiers defeats the entire model. Group Policy 'User Rights Assignment' settings such as Deny log on locally, Deny log on through Remote Desktop Services, and Deny access to this computer from the network are applied to Tier 0 assets to explicitly block Tier 1 and Tier 2 admin accounts from ever authenticating there, closing the path an attacker would otherwise use to pivot upward.

Privileged Access Workstations (PAWs) — hardened, single-purpose machines used only for administrative tasks and never for email or web browsing — provide the physical enforcement point for tier separation, since even a perfectly configured GPO can't help if an admin logs into Tier 0 from a general-purpose laptop that already has malware on it. The Local Administrator Password Solution (LAPS) complements this by randomizing and automatically rotating the local Administrator password on every domain-joined machine, storing it as a confidential attribute in AD, so a leaked local admin password on one workstation can't be reused to move laterally across the entire fleet.

Additional layers reinforce the tiering model: the built-in Protected Users security group strips an account of NTLM, DES, and weak Kerberos encryption support and shortens ticket lifetimes, making credential theft attacks like pass-the-hash far less effective against members; the krbtgt account's password should be rotated twice (with a suitable delay between rotations to let ticket caches expire) at least annually, and immediately after any suspected domain compromise, to invalidate any forged golden tickets; and organizations increasingly pair on-premises tiering with Microsoft Entra Privileged Identity Management (PIM) to grant just-in-time, time-bound elevation instead of standing admin rights. Without disciplined tier enforcement, a single phishing email that compromises a help-desk technician's workstation can, within minutes, become full Domain Admin compromise via pass-the-hash or ticket theft.