Implement the Active Directory Tiered Administration Model (Tier 0/1/2)

Most Active Directory compromises follow the same pattern: an attacker lands on a workstation, harvests credentials, and finds that a Domain Admin logged into that machine at some point — leaving reusable credential material behind. The tiered administration model breaks this chain by ensuring high-privilege credentials never touch lower-trust systems. It is the single most effective structural defense against lateral movement and privilege escalation in a Windows domain.

The three tiers

• Tier 0 — assets that control the identity system itself: domain controllers, AD CS servers, Entra Connect servers, ADFS, backup systems that hold DC backups, and the accounts that administer them. Compromise of any Tier 0 asset means compromise of the entire forest.
• Tier 1 — member servers and the applications running on them: file servers, SQL, application servers, and their administrators.
• Tier 2 — end-user workstations, laptops, and the helpdesk accounts that support them.

The core rule

Credentials from a higher tier must never be used on a lower-tier system. A Tier 0 account never logs into a member server or workstation. A Tier 1 admin never logs into a workstation. Control flows downward, credentials never do. This means every administrator needs separate accounts per tier — for example adm-t0-jsmith, adm-t1-jsmith — in addition to their normal user account.

Implementation steps

• Inventory Tier 0 first. It is always larger than expected: anything that can modify AD, push code to DCs, or restore DC backups belongs in Tier 0 — including SCCM/MECM if it manages domain controllers, and virtualization hosts running DC virtual machines.
• Build an OU structure that reflects the tiers, and create per-tier admin accounts and security groups.
• Enforce logon restrictions with GPOs using the five "Deny logon" user rights (Deny log on locally, Deny log on through Remote Desktop Services, Deny access to this computer from the network, Deny log on as a batch job, Deny log on as a service). Deny Tier 0 accounts on Tier 1 and Tier 2 systems, and Tier 1 accounts on Tier 2 systems.
• Add all admin accounts to the Protected Users group and set the "Account is sensitive and cannot be delegated" flag.
• Roll out in phases: inventory and account creation first, then audit-mode monitoring of violations, then enforcement.

Common pitfalls

• Service accounts with Domain Admin rights running on member servers are the most common tiering violation — remediate these with gMSAs and least-privilege delegation before enforcing deny policies.
• Do not forget virtualization: an ESXi or Hyper-V admin who can access DC virtual disks is effectively Tier 0.
• Helpdesk workflows often break first. Give Tier 2 support staff proper delegated rights (password reset, computer object management) instead of broad group memberships.

Microsoft has evolved this guidance into the Enterprise Access Model, which extends the same principles to cloud and hybrid environments — but for on-premises AD, the classic three-tier model remains the foundation everything else builds on.