The most common Active Directory takeover does not start at a domain controller. It starts at a workstation where an administrator logged on with their one and only account to check something. The credentials stay in memory, the workstation is already infected, and the attacker receives an account with full privileges as a gift. The tiering model exists to make that scenario impossible.
Three tiers
Systems and accounts are grouped by what their compromise gives an attacker:
- Tier 0: everything that controls identity in the organisation. Domain controllers, the certificate authority, the hypervisors that host domain controllers, the backup system that has access to them, and accounts with domain or enterprise administrator rights.
- Tier 1: application servers, databases, business services and the accounts of the administrators of those servers.
- Tier 2: workstations, user devices, user accounts and support staff accounts.
There is one rule: credentials of a higher tier never touch a system of a lower tier. A domain administrator does not log on to an application server or a workstation. A server administrator does not log on to a user’s workstation with their server account.
What it means in practice
Every person with administrative rights has separate accounts for each tier they work in. A typical administrator in a small organisation has three: a regular user account for email and documents, an account for servers, and a Tier 0 account used rarely and only on domain controllers and systems equivalent to them.
Administrative accounts have no mailbox, are not used for web browsing, and do not log on to computers where somebody does those things.
Enforcement through Group Policy
A model that relies on discipline alone stops working at the first urgent outage. Enforcement comes from Group Policy, in the user rights assignment section:
- on workstations: deny log on locally, through Remote Desktop, as a batch job and as a service for the Tier 0 and Tier 1 administrator groups,
- on Tier 1 servers: the same denials for Tier 0 groups,
- on domain controllers: interactive logon only for the Tier 0 administrator group.
Tier 0 accounts also go into the Protected Users group, which disables weaker authentication mechanisms and shortens Kerberos ticket lifetimes. Local administrator passwords on every machine are unique and rotated automatically, so that compromising one workstation does not unlock the others.
The admin workstation
Tier 0 is accessed only from a designated place: a dedicated admin workstation without email or a browser, or a jump host that itself belongs to Tier 0 and requires multi-factor authentication. In the smallest organisations a single virtual machine with a restrictive policy and no internet access is sufficient.
Rollout step by step
- Inventory: who is in the privileged groups and what they actually use. Usually half the members should not be there.
- Create tiered accounts and groups for each tier.
- Deploy the deny policies in audit mode: first monitor logon events of privileged accounts on the wrong systems, then block.
- Move tasks that required a domain account logon on workstations to tools running in the system account context or through remote management.
- Enable enforcement and review denial events for the first few weeks.
Summary
The tiering model needs no budget, only a decision and consistency. Separate accounts, a few Group Policy settings and one place to work on domain controllers mean that an infected workstation stays a workstation incident rather than the beginning of a full domain rebuild.