The Active Directory tiering model explained: Tier 0, Tier 1, and Tier 2

Three tiers

Tier 0 is everything that controls identity: domain controllers, AD itself, AD CS, Entra Connect servers, and the accounts and systems that manage them. Tier 1 is servers and enterprise applications. Tier 2 is workstations and user devices. The rule is that credentials from a higher tier never log on to a lower-tier system, because lower tiers are more exposed and an attacker there can harvest what logs on.

Microsoft’s newer enterprise access model describes the same idea as control, management, and data planes. The principle is unchanged.

Where to start

Create separate admin accounts per tier for each administrator, for example a-jdoe-t0 and a-jdoe-t1. Use Group Policy “Deny log on locally”, “Deny log on through Remote Desktop Services”, and “Deny access to this computer from the network” to stop Tier 0 accounts from logging on to Tier 1 and Tier 2 systems. Provide privileged access workstations for Tier 0 work.

Inventory what is Tier 0. Backup servers that can restore DCs, virtualization hosts running DCs, and management agents installed on DCs are Tier 0 too, and are often missed.

Lab: enforce one boundary

In the lab, create a Tier 0 Admins group and an admin account in it. Create a GPO linked to the Workstations OU that adds Tier 0 Admins to the three deny logon rights. Try to log on to the workstation with the Tier 0 account and confirm it is refused. Check Event 4625 with status 0xC000015B, “the user has not been granted the requested logon type”.

Then use 4624 and 4672 queries from the Windows set to list where Tier 0 accounts have logged on in the past 30 days, which shows how far reality is from the model.

Snippet

# GPO linked to OU=Workstations: Computer Config > Windows Settings > Security Settings > Local Policies > User Rights Assignment
#   Deny log on locally: LAB\Tier 0 Admins
#   Deny log on through Remote Desktop Services: LAB\Tier 0 Admins
#   Deny access to this computer from the network: LAB\Tier 0 Admins
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-1)} | Where-Object { $_.Message -match '0xC000015B' } | Select TimeCreated -First 5

Growing the model

After logon restrictions, add Protected Users for Tier 0 accounts, authentication policy silos, just-in-time membership, and separate management infrastructure for Tier 0. Each step reduces the chance that a phished user leads to the domain.

Perfect tiering is rare. Partial tiering focused on Tier 0 still removes the most damaging paths.

Diagram

Without and with tiering

What one compromised workstation exposes.

No tiering

Admin logons. Domain admins RDP to workstations for support.

Exposure. Domain admin credentials in workstation memory.

Result. One laptop to full domain.

Tiered

Admin logons. Workstation support uses Tier 2 accounts only.

Exposure. Only Tier 2 credentials on workstations.

Result. Compromise contained to Tier 2.

Check yourself

1. Which systems belong in Tier 0?

2. What is the core tiering rule?

3. A Tier 0 account is denied at a workstation. Which status appears in 4625?