AD tiering and the admin model
Separating Tier 0, Tier 1 and Tier 2 admin accounts so a compromised workstation can't hand over the domain.
DRAFT OUTLINE. This page is a structure to fill in, not finished research.
# Lab environment
- A small home Active Directory lab (details kept general on purpose)
- [TBD: generic lab summary for this write-up: no host names, IPs or domain names]
# Why tiering matters
- What credential theft looks like when admins log on everywhere
- [TBD: a short real-world-style scenario in your own words]
# Defining the tiers in my lab
- What counts as Tier 0 (DCs, AD itself, identity infrastructure)
- Tier 1 servers and Tier 2 workstations
- [TBD: how you mapped your lab objects to tiers]
# Separate admin accounts
- Naming convention and OU layout
- [TBD: screenshots of your OU structure]
# Enforcing logon restrictions
- GPO 'Deny log on' rights per tier
- Authentication policies and silos
- Protected Users group
- [TBD: what you applied and what broke]
# Results and lessons
- [TBD: what you'd recommend for a real environment]
# References
- [TBD: sources you used]