A security model that separates Active Directory administration by sensitivity level to limit the impact of compromise. It assigns admins to distinct tiers for identity infrastructure, servers, and workstations, enforcing least privilege and reducing lateral movement. Access at a lower tier must never be used to manage a higher-tier asset.
Why Active Directory tiering exists
active directory tiered administration is a containment model, not just an organisational chart. By separating administrators, credentials, and management paths by sensitivity, it reduces the chance that a compromise in a lower-trust area can be used to reach the identity control plane.
The model is usually explained as a Tier 0, Tier 1, and Tier 2 boundary. Tier 0 covers the most sensitive identity infrastructure, while lower tiers cover servers and endpoints. The core rule is simple: access used to manage one tier must never be reused to manage a higher tier.
What each tier protects
Tier 0 is where the highest-value identity assets live, such as domain controllers, directory services, authentication systems, and the administrative paths that can change them. If this layer is exposed, the attacker can often alter trust, issue privileges, or persist in ways that are difficult to unwind.
Tier 1 typically covers servers and the services they host. Tier 2 covers workstations and user-facing endpoints. These tiers are not just labels, they are trust boundaries that help ensure a compromise on a workstation does not automatically become control of server administration, and a server compromise does not automatically become directory compromise.
Why tier separation changes the attack surface
The main security value of tiering is blast-radius reduction. It prevents credential reuse across trust levels, blocks lateral movement from a lower administrative context to a higher one, and makes it easier to identify when an administrative boundary has been crossed inappropriately.
It also changes how organisations design admin workflows. Logging on to a workstation for email, browsing, or general productivity should not expose the same privileged session that manages directory infrastructure. That separation matters because one stolen token, cached credential, or remote session can otherwise become a shortcut to the most sensitive systems.
How the model is enforced in practice
Tiering only works when it is enforced consistently through separate admin accounts, separate devices or privileged workstations, and strict logon restrictions between tiers. The operating assumption is that lower-trust environments are more likely to be phished, malware-infected, or otherwise exposed, so they must not become stepping stones to higher-trust systems.
In mature environments, tiering is paired with hardening of the identity plane, strong administration boundaries, and careful control of where privileged credentials can be presented. The result is not perfect isolation, but a much narrower path for an attacker to escalate from routine compromise to full directory control.
Risk and Threat Considerations
The biggest risk is tier crossover, where an administrator signs into a lower-tier system and exposes credentials or session material that can be used to reach a higher tier. Once that happens, the attacker can pivot from ordinary endpoint or server access into the identity infrastructure that governs the whole environment.
Failure mechanism: Credential theft, token replay, remote session abuse, or admin workstation compromise breaks the separation between tiers and creates a path to privilege escalation and lateral movement.
Impact: A successful crossover can lead to domain-wide compromise, persistence in directory services, and the ability to alter authentication, authorization, and recovery paths across the estate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Tiered administration depends on strong admin authentication at each tier. |
| AC-6 — Least Privilege | Tiering is a least-privilege design that limits cross-tier administrative reach. | |
| AC-2 — Account Management | Distinct admin accounts are needed to keep lower- and higher-tier access separated. | |
| Recommendation — Use IA-2 to authenticate privileged administrators separately for each tier. Apply AC-6 to restrict admins to the minimum tiered access they need. Use AC-2 to provision and manage separate administrative accounts per tier. | ||
| NIST Zero Trust (SP 800-207) | 3 — Principles and Concepts | Tiered administration applies zero-trust separation and explicit trust boundaries to admin paths. |
| Recommendation — Use Zero Trust principles to enforce explicit trust boundaries between administrative tiers. | ||
| CIS Controls v8 | 6 — Access Control Management | Tiered administration is an access-control design that separates privileged paths by sensitivity. |
| Recommendation — Use CIS-6 to segment administrative access by tier and enforce separate privileges. | ||
Practitioner Guidance
Why practitioners should care: Tiered administration is only effective when it is treated as an operating model, not a naming convention. The practical challenge is keeping admin behaviour, devices, and credentials aligned with the tier they are allowed to touch.
What to watch for: Shared admin accounts, interactive logons from the wrong tier, and “temporary” exceptions are usually the first signs that the model is being eroded. In most environments, those exceptions become the pathway that defeats the whole design.
Practitioner takeaway: If lower-tier access can ever be used to manage a higher-tier asset, the tiering model is already failing.
Related resources from NHI Mgmt Group
- Guide: Tiered Administration and Enterprise Access Model Guide
- What is the difference between a privileged access workstation and Active Directory tiered administration?
- How do organisations know whether their Active Directory delegation model is actually working?
- What breaks when Active Directory administration lacks real-time traceability and investigation context?
- How should security teams implement privileged access workstations for Active Directory administration?