Deploy Privileged Access Workstations (PAW) for Tier 0 Administration

Tiering separates accounts, but accounts still get typed into keyboards — and if that keyboard belongs to a machine that also opens email, browses the web, and runs whatever the user installed, the separation is only as strong as that machine. A Privileged Access Workstation closes this gap: a dedicated, hardened device used exclusively for administrative work, with no email client, no general web browsing, and no productivity software. If Domain Admin credentials only ever touch a PAW, phishing the admin's daily-driver laptop no longer yields Domain Admin.

Core design principles

• Clean source — the PAW must be built from trusted media through a trusted process, and managed only by systems at the same or higher trust level. A PAW managed by a Tier 1 MECM server is not a PAW.
• No productivity workloads — no email, no Office, no general browsing. The allowed destinations are admin portals, management servers, and documentation, enforced by proxy or firewall allowlists.
• Hardware-backed security — TPM 2.0, Secure Boot, BitLocker, Credential Guard, and VBS enabled from day one.
• Application control — WDAC or AppLocker in enforce mode. On a single-purpose device, allowlisting is actually easy: the software set is small and stable.

Deployment models

• Dedicated hardware — the admin carries two devices: a normal laptop for daily work and a PAW for privileged work. Strongest isolation, highest cost.
• PAW as host, productivity as VM — the physical machine is the PAW; the user's daily environment runs inside a VM on it. Acceptable, because a compromise of the guest does not compromise the host.
• Never the reverse — running the "secure" environment as a VM on a normal workstation provides no protection: the untrusted host can keylog and screen-capture everything inside the VM.

Implementation steps

• Start with Tier 0 operators only — typically a handful of people. This keeps cost and friction manageable while protecting the highest-value credentials first.
• Place PAW computer objects in a dedicated Tier 0 OU with their own GPO baseline: deny inbound connectivity, restrict outbound to an explicit allowlist, disable removable media, and block all non-PAW accounts from logging on.
• Enforce that privileged accounts can only log on from PAWs, using authentication policies and silos or logon workstation restrictions — otherwise admins will fall back to convenience.
• Pair the PAW with jump servers where needed, but remember: a jump server accessed from an untrusted workstation adds little. The security of the session is anchored at the keyboard.
• Extend to Tier 1 admins and cloud administration (Entra ID Global Admins) as the program matures.

Common objections

• "Two devices is expensive." Compare the cost of a laptop against the cost of a forest-wide compromise and rebuild. For most organizations, five to ten PAWs cover all of Tier 0.
• "Admins will resist." They will — until the workflow is smooth. Fast sign-in, good hardware, and a clear allowlist process matter more than policy documents.

PAW is the natural continuation of the tiering model: tiering decides which account may administer a system, PAW decides from which keyboard that account may be used. Together they remove the two most common paths to Domain Admin.