Active Directory Tiering and Privileged-Account Review
Active Directory tiering limits which credentials can control which assets. It is not an organisational chart and it is not a list of administrator titles. It is a logon and delegation boundary. Microsoft’s enterprise access model expands older AD tiers into control, management, and workload planes, but Tier 0, Tier 1, and Tier 2 remain useful labels for a Windows estate when every account, endpoint, and service has a recorded boundary.
Define the tiers before reviewing groups
Tier 0 includes identity control-plane assets: domain controllers, AD CS, Entra Connect or other identity synchronisation, privileged directory groups, and systems able to change those systems. A compromise here can change trust for the estate.
Tier 1 includes server and management-plane administration: member servers, hypervisors, management consoles, backup infrastructure, and server administration identities. Tier 1 does not administer Tier 0.
Tier 2 includes user workstations, help-desk operations, and standard productivity services. Tier 2 credentials do not administer servers or directory control-plane systems.
Record exceptions by capability, not hostname. A jump host with Domain Admin logons is Tier 0 even if its inventory label says “operations.” A backup console is Tier 1 unless it can restore or alter a domain controller; then the reviewed capability may make it Tier 0.
Enforce separate identities and PAWs
A privileged administrator needs a separate account for each permitted tier. Standard email, browsing, chat, and document work belongs to the daily account, never to Tier 0. A Privileged Access Workstation (PAW) is an enforced admin path, not a badge. Review its device enrolment, allowed sign-in policy, local administrator membership, management endpoint, MFA or equivalent access condition, patch evidence, and whether web and mail are blocked or tightly constrained.
Test both directions. Attempt Tier 0 account sign-in from a normal workstation and record pass only if policy blocks it. Attempt Tier 2 or daily-account sign-in to a PAW and record the expected denial. Then establish that the PAW can reach the named Tier 0 administration endpoint through an authenticated, logged path. Screenshots alone do not establish enforcement; preserve policy export, sign-in result, timestamp, and reviewer.
Trace delegation paths
Delegation can bypass tiering. Inventory unconstrained delegation, constrained delegation, resource-based constrained delegation, services trusted for delegation, and accounts allowed to delegate. Unconstrained delegation on a lower-tier server creates a material path for credentials presented to it. Do not treat a checkbox as harmless because a service still functions.
For every legitimate delegation record service account, source service, target SPN, protocol transition requirement, owner, approval, and expiry. Test a prohibited source-to-target path and record pass only when ticket use fails without exposing secrets. Remove unneeded delegation, then retest the application’s approved flow. If removal breaks a business dependency, retain a time-bounded exception with compensating segmentation and monitoring, not an undocumented permanent waiver.
Completed review example
| Review item | Evidence and test | Result | Action |
|---|---|---|---|
DC-01 | Tier 0 register; normal workstation sign-in denied | Pass | Keep PAW-only policy |
ops-jump-02 | Domain Admin interactive logon discovered | Fail | Reclassify Tier 0; restrict sign-in |
svc-report | Constrained delegation only to documented report SPN | Pass | Owner revalidates quarterly |
app-old-01 | Unconstrained delegation enabled | Fail | Remove after approved service test |
The example is a workbook pattern, not evidence about any organisation. Every failed result needs an accountable owner, remediation target, and retest. An exception states the exact asset, reason, risk owner, compensating control, and expiry date. Expiry without reapproval returns the item to failed.
Review output
Deliver a tier register, privileged-group membership snapshot, PAW enforcement results, delegation-path register, and exception list. Avoid claims that a tier model “prevents” compromise. It reduces opportunity for a lower-trust credential or endpoint to control a higher-trust plane when its policies, access paths, and exceptions are continuously verified.
Operational cadence
Review Tier 0 group membership after privileged role changes, review PAW policy after endpoint-management changes, and review delegation whenever a service is introduced or moved. Correlate directory changes with sign-in and ticket telemetry. A reviewer should be able to trace every privileged account to one tier, one owner, one permitted workstation class, and one documented administration purpose. Keep break-glass access separate, highly restricted, tested under an approved procedure, and included in the Tier 0 register. A test failure does not require an exploit demonstration: a successful prohibited logon or delegation route is sufficient evidence to contain access, open remediation, and retest. Store evidence references rather than copied credential data. This cadence detects drift before a convenience permission becomes a persistent control-plane path.
Validate administration paths
Review group membership is necessary but cannot prove usable access. From a controlled PAW, use an approved Tier 0 test account to query the intended administrative surface; from a Tier 2 workstation, repeat only the safe authentication attempt and record denial. Preserve the signed-in identity, device name, target, policy result, and correlation ID. For directory delegation, export relevant ACLs and use a read-only LDAP query against the named OU. Compare memberOf, nested-group expansion, and delegated rights with the tier register. A principal reachable through a nested support group is still a privileged path, even when no direct Domain Admin membership appears. Record the path, control owner, and retest condition before removing access.