The Problem

In default Active Directory environments:

  • Domain Admins log into workstations to fix issues
  • Their credentials are cached and can be stolen
  • Attackers use mimikatz/LSA dumps to escalate from any compromised host to DA

The Tiering Model

Tier 0 — Crown Jewels

Assets: Domain Controllers, ADFS, PKI, Azure AD Connect Accounts: Only Tier 0 admins Rule: Tier 0 admins NEVER log into Tier 1 or Tier 2 systems

Tier 1 — Servers

Assets: Application servers, file servers, exchange Accounts: Server admins (cannot log into DCs or workstations) Rule: Tier 1 accounts have no rights on DCs or workstations

Tier 2 — Workstations

Assets: End-user devices Accounts: Helpdesk accounts (workstation admin only) Rule: Tier 2 accounts cannot authenticate to servers or DCs

Implementation Steps

Step 1: Create Tier OUs and Groups

# Create Tier 0 admin accounts OU

New-ADOrganizationalUnit -Name 'T0-Accounts' -Path 'OU=AdminAccounts,DC=corp,DC=local'


New-ADOrganizationalUnit -Name 'T1-Accounts' -Path 'OU=AdminAccounts,DC=corp,DC=local'


New-ADOrganizationalUnit -Name 'T2-Accounts' -Path 'OU=AdminAccounts,DC=corp,DC=local'

Step 2: Enforce with Authentication Policy Silos

Use AD Authentication Policy Silos (Windows Server 2012 R2+) to restrict where accounts can be used.

Step 3: Privileged Access Workstations (PAW)

Tier 0 and Tier 1 admins use dedicated PAW devices that only connect to their tier resources.

Step 4: Audit and Monitor

  • Event ID 4625: Failed logon (wrong tier authentication attempts)
  • Event ID 4648: Explicit credential use (pass-the-hash indicator)
  • Deploy Microsoft Defender for Identity for tier violation alerting