Build a Tiered Admin Model in Active Directory

Why this lab matters

When a Domain Admin signs in to a workstation to fix a printer, their credentials sit in that machine's memory. If the workstation is already compromised, the attacker now has the domain. Tiering is the rule that prevents this: an account that controls a higher tier must never log on to a lower tier. Microsoft now describes this within its enterprise access model, and the three tier layout remains the practical way to apply it on premises.

Tier	What it contains	Example admin account
Tier 0	Domain controllers, AD itself, PKI, Entra Connect, the PAM vault	t0-jsmith
Tier 1	Member servers, applications and databases	t1-jsmith
Tier 2	Workstations, laptops and user devices	t2-jsmith

What you need

• A lab domain with one domain controller, one member server and one workstation.
• Domain Admin rights and the Group Policy Management console.
• Working emergency access to the domain controller console, in case a policy locks you out.

Step 1: Build the OU structure and groups

Import-Module ActiveDirectory
$root = (Get-ADDomain).DistinguishedName

New-ADOrganizationalUnit -Name 'Admin' -Path $root
foreach ($t in 'Tier0','Tier1','Tier2') {
  New-ADOrganizationalUnit -Name $t -Path "OU=Admin,$root"
  New-ADOrganizationalUnit -Name 'Accounts' -Path "OU=$t,OU=Admin,$root"
  New-ADOrganizationalUnit -Name 'Groups'   -Path "OU=$t,OU=Admin,$root"
  New-ADGroup -Name "GRP-$t-Admins" -GroupScope Global -GroupCategory Security -Path "OU=Groups,OU=$t,OU=Admin,$root"
}
New-ADOrganizationalUnit -Name 'Servers'      -Path $root
New-ADOrganizationalUnit -Name 'Workstations' -Path $root

Move the member server into Servers and the workstation into Workstations.

Step 2: Create one admin account per tier

$pw = Read-Host -AsSecureString 'Initial password'
foreach ($t in 0,1,2) {
  New-ADUser -Name "t$t-jsmith" -SamAccountName "t$t-jsmith" -AccountPassword $pw -Enabled $true `
    -Path "OU=Accounts,OU=Tier$t,OU=Admin,$root"
  Add-ADGroupMember "GRP-Tier$t-Admins" -Members "t$t-jsmith"
}
Add-ADGroupMember 'Domain Admins' -Members 't0-jsmith'

These accounts have no mailbox and are not used for browsing. The person's everyday account stays a standard user.

Step 3: Grant rights at the right tier

1. Create a GPO T1-Local-Admins linked to Servers. Under Computer Configuration, Preferences, Control Panel Settings, Local Users and Groups, update the built-in Administrators group to add GRP-Tier1-Admins.
2. Create T2-Local-Admins linked to Workstations that adds GRP-Tier2-Admins in the same way.

Step 4: Apply the deny logon rights

In each GPO below, open Computer Configuration, Policies, Windows Settings, Security Settings, Local Policies, User Rights Assignment and add the listed groups to all five rights: Deny access to this computer from the network, Deny log on locally, Deny log on through Remote Desktop Services, Deny log on as a batch job and Deny log on as a service.

GPO	Linked to	Groups to deny
T2-Deny-Higher-Tiers	Workstations	GRP-Tier0-Admins, GRP-Tier1-Admins, Domain Admins, Enterprise Admins
T1-Deny-Other-Tiers	Servers	GRP-Tier0-Admins, GRP-Tier2-Admins, Domain Admins, Enterprise Admins
T0-Deny-Lower-Tiers	Domain Controllers	GRP-Tier1-Admins, GRP-Tier2-Admins

Refresh policy on each machine with gpupdate /force and restart it.

Step 5: Test containment

Test	Expected result
t0-jsmith signs in at the workstation	Refused. The sign-in method you are trying to use is not allowed
t0-jsmith connects by Remote Desktop to the member server	Refused
t1-jsmith signs in at the member server	Allowed, with local admin rights
t1-jsmith signs in at the workstation	Refused
t2-jsmith signs in at the workstation	Allowed, with local admin rights
t2-jsmith connects to the domain controller	Refused

Confirm the applied rights on any machine:

gpresult /r /scope computer
secedit /export /cfg C:\Temp\rights.inf /areas USER_RIGHTS
Select-String -Path C:\Temp\rights.inf -Pattern 'SeDeny'

Step 6: Monitor for tier breaches

Policy can drift, so watch for the thing it prevents. On workstations and servers, a successful logon (event ID 4624) by an account from a higher tier is a breach worth an alert. In a SIEM, match the account name prefix against the tier of the machine. A refused attempt appears as event ID 4625 with status 0xC000015B, which means the logon type was not granted.

Evidence to keep

• A GPO report for each of the three deny policies.
• The completed test table with dates.
• The list of approved exceptions, each with an owner.

Where to go next

Tier 0 admins should work from a dedicated privileged access workstation, and authentication policy silos can bind Tier 0 accounts to Tier 0 machines at the Kerberos level. Pair this lab with the Windows LAPS and Protected Users labs for a much harder domain.