The tiered administration model (tier 0/1/2)
You sort admin accounts and groups into tiers (tier 0: the heart of the domain, tier 1: servers, tier 2: workstations), find rights that jump tiers through nested groups, a tier 0 account used on a workstation and workstation rights granted on the server OU, list the tier 0 inventory and report the tier violations with a fix plan. The details of the violations differ in every lab.
Level 201 · 50 min
Attackers rarely take a domain in one move; they climb step by step. They take over an employee’s computer, collect the credentials of an administrator who logged on there, use that administrator to reach a server, and from there a DC.
The tiered administration model breaks this ladder. Tier 0: everything that controls the domain (DCs, Domain Admins, Enterprise Admins, backup operators, PKI). Tier 1: servers and applications. Tier 2: workstations and the help desk. The basic rule: an admin account logs on only to machines in its own tier, and each tier gets its own account. Tier 0 work is done only from a dedicated, hardened admin workstation (PAW, Privileged Access Workstation). The figure shows the tiers and the forbidden crossings.
Analogy: in a bank, the vault key doesn’t sit on the cashier’s desk. And whoever carries it enters the vault only through its own door.
In this lab three tier violations are set up in the background; they are in place about 30 seconds after the lab starts.
What you will do in this lesson
- The direct members of the tier 0 groups
- The real members of tier 0
- The tier 1 and tier 2 groups
- Where does the tier 0 account log on?
- Who has rights on the server OU?
- Are the tier 0 accounts protected?
- The tier 0 inventory
- The tier violations
- The fix plan
- Short quiz
Skills you will earn
- Applying the tiered administration model (tier 0/1/2)
- Listing the accounts that are effectively tier 0
- Reading logon restrictions (userWorkstations)
- Finding tier violations (nested groups, permissions, logon place)
- Reading an AD object’s permissions (DACL, ACEs)
- Auditing the Protected Users group
- Writing a fix plan for tier violations (PAW, Protected Users)
- Writing audit findings into a report
← DCSync and the abuse of replication rights · Active Directory security: auditing and hardening · SMB and LDAP signing, LDAPS →
Start for free