Lesson 4.9: Tiering: where admins may log on
When an administrator logs on to a computer interactively, their credentials stay in that computer's memory for a while. If that computer is later compromised, so is the admin. The tier model stops this by splitting the estate into tier 0 (domain controllers and what controls them), tier 1 (servers) and tier 2 (workstations), and forbidding admins of a higher tier from logging on to a lower one. In the lab you list the real Domain Admins, find where they log on, discover a tier 0 admin who used RDP on the workstation that was compromised three days later, separate Maya's daily account from her admin role, add the tier 0 admin to Protected Users, and prepare the Group Policy that enforces the rule.
18 min
You will learn to
- Explain the tier model
- List the effective Domain Admins
- Find admin logons on lower-tier machines
- Use Protected Users and separate admin accounts
- Read a deny-logon Group Policy setting
Key terms
- Tier model
- Tier 0: what controls the domain (DCs, AD admins, PKI, sync servers). Tier 1: servers and their admins. Tier 2: workstations and helpdesk.
- Logon types 2 / 3 / 10
- Interactive (keyboard), network (file share), remote interactive (RDP).
- Protected Users
- A built-in group whose members get stronger protections: no NTLM, no RC4/DES, no delegation, no cached logons, short tickets.
- PAW
- Privileged access workstation: a locked-down machine used only for admin work.
- Well-known RIDs
- The last part of a domain SID: 500 Administrator, 512 Domain Admins, 519 Enterprise Admins; S-1-5-32-544 is the local Administrators group.
← Reviewing dependencies through the lockfile · All lessons · False positives and tuning →