<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-ad-tiered-administration
description: >-
  Implement Microsoft's tiered administration model to isolate privileged access across Tier 0 (domain controllers), Tier 1 (servers), and Tier 2 (workstations).
domain: cybersecurity
subdomain: active-directory-security
tags:
  - tiered-admin
  - paw
  - privilege-isolation
  - hardening
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
  frameworks: ["MITRE ATT&CK", "Microsoft PAW"]
  tools: ["powershell", "gpo", "bloodhound"]
---

# Implementing Ad Tiered Administration

## Overview

Implement Microsoft's tiered administration model to isolate privileged access across Tier 0 (domain controllers), Tier 1 (servers), and Tier 2 (workstations).

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `powershell` | Security tooling |
| `gpo` | Security tooling |
| `bloodhound` | Security tooling |
| Domain Admin access, GPO management, OU restructuring permissions | Environment requirement |

## Quick Reference

```bash
# Quick start commands
node scripts/agent.js --help
node scripts/agent.js design --domain corp.local --tiers 3
```

## Workflow

### Step 1: Design Tier Structure

```bash
node scripts/agent.js design --domain corp.local --tiers 3
```

### Step 2: Create Tier OUs and GPOs

```bash
New-ADOrganizationalUnit -Name 'Tier0-Accounts' -Path 'DC=corp,DC=local'
```

### Step 3: Enforce Authentication Policies

```bash
Set-ADAuthenticationPolicy -Name 'Tier0-Restriction' -UserAllowedToAuthenticateFrom 'O:SYG:SYD:(XA;OICI;CR;;;WD;(@USER.ad://ext/AuthenticationSilo == "Tier0"))'
```

## Detection

```yaml
title: Ad Tiered Administration Detection
id: 5a735fcb-c6ad-4bd3-a448-fb123c60a5d4
status: experimental
description: Detects suspicious activity related to implementing ad tiered administration techniques in active directory security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*ad*"
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.credential_access
falsepositives:
  - Authorized Active Directory administration using approved management tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Ad Tiered Administration Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078 |

## Verification

- **Verify tier isolation**: `node scripts/agent.js verify --domain corp.local`
- **Confirm GPO enforcement**: `node scripts/agent.js audit --domain corp.local --check tiers`

## References

- MITRE ATT&CK: T1078
- Frameworks: MITRE ATT&CK, Microsoft PAW
- Tools: powershell, gpo, bloodhound
