Tiered Administration: Defending Active Directory's Crown Jewels

Having designed greenfield Active Directory environments for organisations from national regulators to a 60,000-user global bank, I hold a simple view: if you run AD, the tiered administration model is not optional hardening, it is the difference between an incident and an enterprise rebuild.

The model in one paragraph

Classify every asset and every administrative credential into tiers. Tier 0 is anything that controls identity itself: domain controllers, the AD forest, PKI issuing infrastructure, identity synchronisation servers, privileged IGA components, and every account that administers them. Tier 1 is servers and applications; Tier 2 is user workstations. The single rule that carries the model: credentials never flow downward. A Tier 0 credential must never touch a Tier 1 or Tier 2 system, because wherever a credential is used, it can be stolen.

Why lateral movement dies here

Modern AD compromise is rarely an exotic exploit. It is credential theft plus graph traversal: land on a workstation, harvest cached credentials, find where an admin logged in with too much privilege, repeat until domain dominance. Tiering breaks the graph. When helpdesk credentials cannot administer servers and server admin credentials cannot exist on workstations, the attack path from phishing email to domain controller stops resolving.

What implementation actually requires

• Separate admin accounts per tier - no dual-use accounts, no email on any of them.
• Privileged Access Workstations for Tier 0 work - hardened, cloud-managed, no browsing, no productivity apps. Administering the forest from the same laptop that opens invoices is the model’s most common falsification.
• Logon restrictions enforced by policy - authentication policies and silos, deny-logon rights, so the tier boundaries are technical controls rather than etiquette.
• Just-in-time elevation - standing privilege replaced with time-bound activation and approval, extending the model into the cloud control plane via PIM.
• Local admin password management and lateral-movement hygiene - unique local credentials everywhere, harvested-credential value driven towards zero.

Hybrid raises the stakes

In a hybrid estate, Tier 0 extends into the cloud: the identity sync service, federation trust material, and the cloud roles that can alter authentication all belong in the same protection class as domain controllers. A common and painful gap is treating cloud identity administration as Tier 1 because it is “just SaaS config” - an attacker who owns your conditional access policies owns your enterprise as surely as one who owns your forest.

Start with an honest attack-path assessment, protect Tier 0 first, and accept the friction: the model costs administrator convenience and pays in the currency of attacks that quietly fail.