AD tiering & privileged access design
Part 2 — The implementation: PAWs, silos, Protected Users, LAPS, JIT and the RaMP rollout
Start here
This is Part 2 of 2, the implementation half of privileged access design.
- Part 1: the model. Why tiering exists, Tier 0/1/2, what really counts as Tier 0, the Enterprise Access Model (EAM), the clean source principle, and why Enhanced Security Administrative Environment (ESAE)/Red Forest was retired.
- Part 2 (this page): the implementation. The controls that make the model real, Privileged Access Workstations (PAWs), the Protected Users group, Authentication Policies and Silos, deny-logon Group Policy, Windows Local Administrator Password Solution (LAPS), just-in-time access with Entra Privileged Identity Management (PIM), Credential Guard, break-glass accounts, drift monitoring, and the Rapid Modernization Plan (RaMP) that sequences it all.
Part 1 drew the map. This part is how you actually get there, in an order that makes you safer in week one instead of only at the end of a multi-year project.
Highlight key
- the term being defined
- Key term: bold with a highlighter swash. A concept's defining phrase.
- how something works
- Mechanism: wavy underline. How a piece works or relates to another.
- Risk: what makes an attack possible
- Risk: warm highlight with a dashed edge. Attack prerequisites and dangerous conditions.
- Fix: the mitigation to apply
- Fix: solid green underline. A mitigation or configuration change.
- Verify: how to confirm it worked
- Verify: green underline with a check. How to prove a fix works.
- only if, by default
- Qualifier: bold italic. A word that changes the claim.
4769- Technical literal: monospace chip. Commands, settings, event IDs, exactly as typed.
Plain English first
Part 1 established one rule: powerful admin credentials must only ever appear on equally-protected machines. Knowing the rule changes nothing. This part is the set of switches, policies and habits that enforce it, and a sensible order to turn them on.
It comes down to three moves. Give admins a clean machine to work from, so the credential is never typed on a device that reads email (that's the PAW). Build a boundary the credential can't cross even by accident, so a stolen admin ticket is useless off its home turf (that's Protected Users, Authentication Silos and deny-logon policy). And stop leaving privilege switched on when nobody's using it, so most of the time there's nothing privileged to steal in the first place (that's just-in-time access). A free safety-net account comes first so you can't lock yourself out, and a roadmap (RaMP) decides what to do in which week.
The analogy: the key, the key room, and the sign-out sheet
Part 1 said the master key must never leave the key room. This part installs the hardware. The PAW is the key room itself, a secure space that does nothing but hold and use keys. Protected Users and silos are the rule that the key only turns in the locks it's meant for, and stops working the instant it's carried out of the building. Just-in-time access is a sign-out sheet: the key lives in a safe and you check it out for two hours with a signature, so Fix: most of the time it's locked away, not in anyone's pocket. And the break-glass account is the fire-axe behind glass, for the day the whole system jams.
Why it matters now
Attackers know the model too, so they hunt the gaps in your enforcement: the one admin account left out of the silo, the service account that can't go in Protected Users, the "PAW" that's quietly allowed to browse the web, the policy stuck in audit mode, the permanent Global Admin nobody converted to just-in-time. Risk: Partial deployment is the target: a single exclusion collapses the whole design, and it won't show up unless you're monitoring for it.
The good news is that the highest-impact controls here are Fix: built-in and mostly free, Protected Users, deny-logon Group Policy Objects (GPOs) and Windows LAPS cost nothing but configuration, and they land in the first weeks. The investment pieces (PAWs, the P2 licence for PIM) come after, once the quick wins are protecting you. The discipline is completeness and maintenance: enrol every privileged account, verify each control actually enforces, and watch for drift, because this is a state you keep, not a box you tick.
If you remember only 5 things
- Three moves, not one. A clean device (PAW), a hard boundary (Protected Users + silos + deny-logon), and least standing privilege (JIT). Risk: Any one alone leaves a credential to steal or a ticket to replay.
- The device sets the ceiling. A privileged logon is only as trustworthy as the machine it's typed on, which is the entire reason Fix: PAWs exist.
- Remove standing privilege. Eligible-not-active (JIT/PIM) means most of the time there's no admin credential to steal at all, the single highest-leverage move, so RaMP does it first.
- Build the safety net first. Stand up Fix: break-glass accounts before you tighten anything, or the controls will eventually lock you out.
- Enforcement is coverage, and a state you maintain. Risk: One excluded account or an audit-mode policy undoes it; verify each control binds, and monitor for drift forever.
Core concepts
Fourteen concepts, grouped: first the enforcement model and the clean device (PAW); then the boundary controls (Protected Users, authentication policies, silos, deny-logon Group Policy Objects (GPOs)) and the credential-hygiene controls (LAPS); then least-standing-privilege (Just-In-Time (JIT), Privileged Identity Management (PIM)); then the hardening and safety layers (Credential Guard, break-glass, monitoring); and finally the Rapid Modernization Plan (RaMP) rollout that sequences everything.
01From model to enforcementPart 2 turns the tier model into configuration that enforces itself, along three axes: a clean device, a hard boundary, and least standing privilege.
Part 1 drew the map: Tier 0 credentials may only appear on Tier 0-grade machines. A map changes nothing until it's enforced. This part is the enforcement: a clean device to administer from (the Privileged Access Workstation (PAW)), a boundary the credential can't cross even by mistake (Protected Users, silos, deny-logon Group Policy Objects (GPOs)), and shrinking how much privilege stands idle at all (Just-In-Time (JIT) with Privileged Identity Management (PIM)).
Tiering says 'the Domain Admins (DA) account only on a PAW.' Enforcement means the DA account is in a silo so its ticket only works from the PAW, is in Protected Users so it has no NT LAN Manager (NTLM) hash to steal, and isn't even an admin until PIM activates the role.
TechnicalGo deeper
The three axes map to the clean source principle's three requirements (clean device, account, path) plus the time dimension JIT adds. Tiering limits where, the boundary controls make it stick, and JIT limits when. None is sufficient alone: a PAW with standing DA rights still has a credential to steal; JIT without a silo still lets a live ticket be replayed. The Rapid Modernization Plan (RaMP) rollout (last concept) sequences them so you get protection early instead of after a multi-year build.
02The Privileged Access Workstation (PAW)A PAW is a dedicated, hardened device used only for privileged administration, with no email, no general web browsing, and no productivity apps.
Admins get two machines (or two strongly-isolated environments): an ordinary one for email, documents and the web, and a PAW for admin work. The PAW is locked down so that the one thing it does, administer Tier 0/1, is the only thing it can do. Because it never touches phishing email or random websites, there's no realistic way to compromise it and steal the credential it holds.
To patch a Domain Controller (DC), the admin uses the PAW. To read email about the change ticket, they use their ordinary laptop. The two never mix, so a phishing email can't reach the device where the Domain Admins (DA) credential lives.
TechnicalGo deeper
Microsoft's guidance is blunt: device security sets the ceiling on credential security. Multi-Factor Authentication (MFA) and Conditional Access only operate within the trust of the device that starts the session, so a privileged logon from a dirty workstation is only as trustworthy as that workstation. The PAW is the physical embodiment of clean source. Variants exist, a separate physical machine, a Virtual Desktop Infrastructure (VDI)/Cloud PC admin session, or the 'privileged workstation / user Virtual Machine (VM)' split, but the invariant is that the privileged environment never does risky activities.
03Building and managing a Privileged Access Workstation (PAW)A PAW is hardware-rooted, centrally managed, and application-allow-listed, not just a laptop with some settings changed.
A real PAW has a Trusted Platform Module (TPM) and Secure Boot (so you can trust it booted clean), is enrolled in Microsoft Intune (Intune) (so its restrictive policy is enforced and monitored centrally), runs only approved tools via Windows Defender Application Control (WDAC) or AppLocker allow-listing, blocks internet access except to the specific management endpoints it needs, and is monitored by Endpoint Detection and Response (EDR). It is built from a known-clean image by a clean source, not re-purposed from a user's old machine.
The PAW allows outbound only to Entra ID, Intune and the admin consoles it needs; everything else is blocked. A USB stick or a browser download simply can't run, because WDAC permits only signed, approved binaries.
TechnicalGo deeper
Key build decisions: hardware root of trust (TPM 2.0, Secure Boot, ideally health attestation); management plane (Intune for cloud-managed PAWs, kept clean of lower-tier management); application control (WDAC in enforced mode is stronger than AppLocker); network restriction (host firewall + proxy allow-list); and Risk: the clean-source bootstrap problem, the PAW must be provisioned from Tier 0-grade infrastructure, or you've just inherited the dirtiness of whatever built it. A PAW managed by the same Intune tenant that manages user phones needs careful control-plane separation.
04The Protected Users groupAdding an account to Protected Users applies non-configurable protections that strip away the credential material attackers steal.
Protected Users is a built-in group. Put a sensitive account in it and Windows automatically: blocks NT LAN Manager (NTLM) (so there's no NTLM hash to pass), forbids weak Rivest Cipher 4 (RC4)/Data Encryption Standard (DES) Kerberos (Advanced Encryption Standard (AES) only), caps the Kerberos Ticket-Granting Ticket (TGT) to four hours, blocks Kerberos delegation of the account, and refuses to cache the credential for offline logon. It's a fast, free, high-impact control for your admin accounts.
A domain admin in Protected Users who Remote Desktop Protocols (RDPs) somewhere leaves no NTLM hash and only a four-hour ticket. An attacker who later compromises that host finds far less to steal, and what they find expires fast.
TechnicalGo deeper
Mechanics and limits: protections require the Primary Domain Controller (PDC) emulator on Windows Server 2012 R2 or later, and AES keys must exist (change the password against a modern Domain Controller (DC) first). It is Risk: not for service or computer accounts, which break without NTLM/cached creds, use silos for those. The built-in Administrator (Relative Identifier (RID) 500) is a documented partial-coverage case, don't rely on it there. Keep at least one break-glass account out of the group, since there are no overrides. Protected Users reduces the loot and shortens its shelf life; it is not, by itself, a boundary (that's silos).
05Authentication policiesAn authentication policy sets a privileged account's Ticket-Granting Ticket (TGT) lifetime and the conditions under which it may authenticate.
Where Protected Users applies a fixed bundle, an authentication policy is tunable. It can set a custom (often short) TGT lifetime for an account, and attach access-control conditions, for example 'this account may only get a ticket when the request comes from a device in the Tier 0 device group.' You author it once and assign it to accounts, directly or via a silo.
A policy on the Tier 0 admin accounts sets a one-hour TGT and requires that the authenticating device belongs to the 'Tier 0 Privileged Access Workstations (PAWs)' group, so a Domain Admins (DA) ticket simply won't issue from anywhere else.
TechnicalGo deeper
Authentication policies rely on Kerberos claims, compound authentication and armoring (FAST), so Domain Controllers (DCs) and clients need the Key Distribution Center (KDC) and Kerberos-client armoring Group Policy Object (GPO) settings, and forest-wide policies need a 2012 R2 Domain Functional Level (DFL). The device-based conditions are what make 'only from a PAW' a KDC-enforced fact rather than a hope. Policies can be deployed in an audit mode first (Verify: log what would be denied) before enforcing, which is the safe rollout path.
06Authentication policy silosA silo is a container that groups privileged accounts, devices and services and confines them to each other.
A silo ties things together: put the Tier 0 admin accounts, the Privileged Access Workstations (PAWs) and the Domain Controllers (DCs) in one silo, and the Key Distribution Center (KDC) will only issue those accounts' tickets when they come from silo member devices, and those accounts can only sign in to silo member hosts. It's the boundary that makes the cardinal rule self-enforcing, one place to express 'Tier 0 accounts live only on Tier 0 machines.'
The Tier 0 silo contains adm0-* accounts, the PAWs and the DCs. If adm0-jordan's ticket is somehow lifted and replayed from a Tier 1 server, the KDC refuses it, because that server isn't in the silo.
TechnicalGo deeper
A silo both assigns an authentication policy and enforces membership-based restrictions; an account belongs to exactly one silo. It needs armoring (FAST) end to end, which is the usual deployment snag, non-armoring-capable clients fail, so you stage it. Silos are the strongest native boundary Active Directory (AD) offers, but they protect the accounts you actually put in them: an admin account left out, or a DC missing from the silo, is the gap attackers look for. Pair silos (the boundary) with Protected Users (less loot) and deny-logon Group Policy Objects (GPOs) (defense in depth).
07Deny-logon Group Policy Objects (GPOs): the enforcement matrixDeny log on rights, applied by GPO per tier, are the broad-strokes enforcement that a higher-tier account can't sign in to a lower-tier host.
Five logon rights (Deny log on locally, through Remote Desktop Services, as a batch job, as a service, and over the network) let you write a matrix: Tier 0 accounts are denied logon on Tier 1 and Tier 2; Tier 1 accounts are denied on Tier 0 and Tier 2; and so on. Applied through each tier's Organizational Unit (OU), this stops the accidental cross-tier logon that silos might miss and covers down-level hosts.
A GPO on the workstation OU denies Tier 0 and Tier 1 admin groups all five logon types, so even if an admin tries to Remote Desktop Protocol (RDP) in with a Domain Admins (DA) account, Windows refuses before any credential is cached.
TechnicalGo deeper
This is the control that works everywhere, no armoring, no functional-level requirement, down to legacy hosts, which is why it's a quick win. The design is a deny matrix keyed on tier admin groups and tier OUs. Subtleties: service and batch rights catch the sneaky exposures (a Tier 0 account running a scheduled task on a server); you must avoid locking out legitimate management (Tier 0 admins still need to log on to Tier 0 hosts); and Risk: deny rights override allow, so test carefully. Silos are stronger where supported; deny-logon GPOs are the universal floor.
08Windows Local Administrator Password Solution (LAPS)Windows LAPS gives every machine a unique, automatically-rotated local administrator password, escrowed in Active Directory (AD) or Entra ID.
A single shared local-admin password (from a gold image) means one stolen hash unlocks the whole fleet, the force-multiplier from Part 1. LAPS fixes it: each machine gets its own random local-admin password, rotated on a schedule, stored encrypted in the directory and readable only by authorized admins. One compromised machine's local hash is then useless anywhere else.
An attacker pass-the-hashes the local Administrator from a phished laptop to the next machine, and it fails, because LAPS gave that machine a different password. The lateral-movement chain breaks at the first hop.
TechnicalGo deeper
Windows LAPS is built into Windows since the April 2023 update, no agent, and backs up to AD or to Entra ID (for cloud/hybrid-joined devices) with role-based read access and audit logging. Password encryption in AD requires a 2016 Domain Functional Level (DFL). Watch the read permissions: Risk: over-broad rights to read the LAPS attribute re-create a shared-secret problem. The legacy Microsoft LAPS product is deprecated; migrate. LAPS doesn't remove local admin, it de-correlates it, which is exactly what defeats fleet-wide pass-the-hash.
09Just-in-time and least standing privilegeJust-In-Time (JIT) means privilege is activated for a short, approved window, not held permanently, so most of the time there's nothing privileged to steal.
The deepest reduction isn't protecting a standing admin credential, it's not having one. With JIT, an admin is eligible for a role but not active in it; they request activation when they need it, it's granted for a few hours with approval and Multi-Factor Authentication (MFA), then it lapses. Standing privilege trends toward zero, and a stolen credential for a dormant account grants nothing.
Jordan is eligible for Domain Admin but is a plain user by default. To patch a Domain Controller (DC), Jordan activates the role for two hours (MFA + a reason, maybe an approver), does the work, and the rights expire automatically.
TechnicalGo deeper
This is the single highest-leverage idea in modern privileged access, and Rapid Modernization Plan (RaMP) puts it first ('stop the accumulation of new risk'). The mental shift: measure and drive down standing privilege as a core metric. Caveats: you need genuine break-glass accounts for when the JIT system itself is down; some on-prem Tier 0 operations are awkward to make fully JIT; and JIT controls when a role is active, not where the credential appears, so you still need Privileged Access Workstations (PAWs) and silos. JIT shrinks the time window; the others shrink the device and boundary surface.
10Entra Privileged Identity Management (PIM)PIM is Microsoft Entra's Just-In-Time (JIT) engine: eligible role assignments activated with approval, Multi-Factor Authentication (MFA), time limits and an audit trail.
PIM is how JIT is delivered for cloud and hybrid roles. You make people eligible for Entra roles (Global Administrator, etc.) rather than permanently assigning them. Activation requires MFA, a justification, optionally an approver, and is time-boxed. Every activation is logged. For a hybrid estate this is the control plane for cloud admin, and the model to mirror on-prem.
A Global Administrator role is assigned to no one permanently. When someone needs it, they activate through PIM for four hours with approval; the Security Operations Center (SOC) sees the activation, and the role auto-deactivates.
TechnicalGo deeper
PIM requires an Entra ID P2 (or Entra ID Governance) license per user who uses it. Harden the activation path: phishing-resistant MFA, short durations, approval for the highest roles, and Conditional Access that requires a compliant/Privileged Access Workstation (PAW) device, otherwise Risk: a phished session can simply activate the role. On-prem has no native PIM; JIT there comes from temporary group membership (TTL-based), a Privileged Access Management (PAM) tool, or Microsoft Identity Manager. Always keep Fix: at least two break-glass accounts excluded from PIM and Conditional Access in case the service is unavailable.
11Credential Guard and Local Security Authority (LSA) protectionCredential Guard uses the hypervisor to isolate secrets so that even local admin on the host can't read them.
Even with Privileged Access Workstations (PAWs) and silos, credentials still land in memory during legitimate use. Credential Guard puts the sensitive parts, NT LAN Manager (NTLM) hashes, Kerberos Ticket-Granting Tickets (TGTs)/keys, into a VBS-isolated enclave the normal Operating System (OS) can't reach, so the usual 'read Local Security Authority Subsystem Service (LSASS)' theft fails. LSA Protection (RunAsPPL) additionally stops untrusted code from tampering with the LSA process. Together they raise the cost of credential theft on every protected host.
An attacker with SYSTEM on a Credential-Guard machine runs their memory-dumping tool and gets ciphertext or nothing useful, the TGT and hash live in the enclave, not in reachable LSASS memory.
TechnicalGo deeper
Credential Guard relies on Virtualization-Based Security (VBS) (hypervisor, Secure Boot, ideally Trusted Platform Module (TPM)) and is on by default on Windows 11 22H2+ Enterprise and Windows Server 2025 where hardware allows (and not previously disabled). Limits: it protects Risk: domain credentials cached for Single Sign-On (SSO), not everything, it doesn't stop keyloggers or a live attacker using the session, and it's defense-in-depth, not a substitute for tiering. It's the 'and even if a credential does land here, make it unstealable' layer under PAWs, silos and Just-In-Time (JIT).
12Emergency access (break-glass) accountsBreak-glass accounts are a tiny number of highly-protected, standing-access accounts kept for when the normal privileged-access system fails.
Every control in this part can also lock you out: a silo misconfigured, Privileged Identity Management (PIM) down, Conditional Access misfiring, Multi-Factor Authentication (MFA) provider offline. Break-glass accounts are the deliberate exception, two or more cloud-only Global Admin (and on-prem Domain Admin) accounts, excluded from Conditional Access and PIM, with very long complex credentials split and stored offline, and heavily alerted so any use is noticed immediately.
A Conditional Access change accidentally blocks all admins. The team retrieves a break-glass credential from the safe, signs in, and fixes it, an event that pages the whole security team by design.
TechnicalGo deeper
Rapid Modernization Plan (RaMP) lists emergency access accounts as its very first item, precisely because the rest of the program can cause lockouts. Design points: at least two, stored and tested separately, Fix: excluded from the automated controls but monitored harder than anything else (alert on any sign-in), credentials rotated after use, and periodically exercised so they actually work when needed. They're the safety net that makes aggressive Just-In-Time (JIT) and Conditional Access safe to deploy.
13Monitoring and tier driftThe design degrades silently, so you must alert on boundary violations and on the controls themselves changing.
Tiering isn't a project you finish; it's a state you maintain. People add exceptions 'just this once,' new systems get stood up outside the model, a Domain Controller (DC) gets left out of the silo, someone grants standing admin again. Monitoring catches the drift: alert when a Tier 0 account authenticates from outside its silo, when NT LAN Manager (NTLM) is attempted by a Protected Users member, when a silo/policy is modified, when standing privilege is granted, or when a Privileged Access Workstation (PAW)'s configuration deviates.
A Tier 0 admin account suddenly gets a ticket from a Tier 1 subnet, the silo denies it and raises event activity; the Security Operations Center (SOC) investigates and finds someone tried to bypass the PAW. The boundary held and the attempt was visible.
TechnicalGo deeper
Concrete signals: Key Distribution Center (KDC)/silo denial events and Kerberos armoring failures; 4625/NTLM from a Protected Users member; changes to authentication policies/silos and to Tier 0 group membership (4728/4732/4756, 5136); Privileged Identity Management (PIM) activation logs; Local Administrator Password Solution (LAPS) read auditing; and PAW compliance state in Microsoft Intune (Intune). Verify: The key metric to trend is standing privileged accounts and tier-boundary violations over time. Feed it all to the Security Information and Event Management (SIEM) and treat any Tier 0 anomaly as a potential domain-takeover in progress.
14The Rapid Modernization Plan (RaMP) rolloutRaMP sequences the whole program: stop new privileged risk first, then clean up existing risk, across identity, devices and policy.
Doing everything at once fails; doing it in the wrong order wastes effort. RaMP's principle is to stop the accumulation of new risk before cleaning up the old. In practice: first secure the identity control plane (stand up break-glass accounts, turn on Privileged Identity Management (PIM)/Just-In-Time (JIT), stop issuing new standing admin), then secure devices (deploy Privileged Access Workstations (PAWs)), then tighten policy (Conditional Access, interface restrictions), expanding coverage as monitoring matures.
Rather than a two-year PAW build before anything improves, a team turns on Protected Users and deny-logon Group Policy Objects (GPOs) in week one, stands up break-glass and PIM in month one, and rolls PAWs and silos tier-by-tier after, protected the whole way.
TechnicalGo deeper
RaMP frames each step as an objective with owners and measurable key results, and maps access to three security levels, Enterprise (baseline), Specialized (high-impact roles), and Privileged (control plane/Tier 0), so you apply the strongest controls where they matter most. It explicitly replaces the heavyweight Enhanced Security Administrative Environment (ESAE) approach from Part 1. The throughline for the series: tiering (Part 1) is the target state; RaMP is the route; and the controls in this part are the vehicle, sequenced so you're Fix: safer in week one, not only at the end.
Visual map
Three step-throughs. The first is the full stack working together, a just-in-time admin action from a Privileged Access Workstation (PAW). The second shows the same Part 1 foothold hitting the controls and being contained. The third is the cautionary one: a partial deployment with a single excluded account, and how that one gap collapses the whole design.
Protected Users vs. Silos vs. Deny-logon Group Policy Objects (GPOs)
These three are often confused. They're complementary: Protected Users shrinks the loot, silos are the strong boundary, deny-logon GPOs are the universal floor.
| Protected Users | Authentication policy silo | Deny-logon GPO | |
|---|---|---|---|
| What it does | Strips credential material (no NT LAN Manager (NTLM), AES-only, 4h Ticket-Granting Ticket (TGT), no delegation/caching) | Key Distribution Center (KDC) confines siloed accounts to siloed devices | Denies logon rights per tier Organizational Unit (OU) |
| It is a… | Loot reducer, not a boundary | Boundary (strongest native) | Boundary (broad floor) |
| Requirements | Primary Domain Controller (PDC) emulator 2012 R2+, Advanced Encryption Standard (AES) keys | Kerberos armoring (FAST), 2012 R2 Domain Functional Level (DFL), enforce mode | None, works on legacy hosts |
| Account types | User accounts only | Users, computers, services | Any account/group |
| Main pitfall | Excluded accounts (service, Relative Identifier (RID) 500) | Half-deployed / audit mode / missing members | Deny overrides allow, test for lockout |
Privileged Identity Management (PIM): eligible vs. active
| Standing (permanent) | Eligible (JIT) | |
|---|---|---|
| Rights held by default | Always active | None until activated |
| To use the role | Already have it | Activate: Multi-Factor Authentication (MFA) + reason + (approval), time-boxed |
| Credential to steal | Always present | Only during the short active window |
| Audit trail | Assignment only | Every activation logged |
| Rapid Modernization Plan (RaMP) priority | What you're removing | What you're moving to |
Technical deep dive
TechnicalUnder the hood
How a silo actually denies a replayed ticket
When an account is assigned an authentication policy (directly or via a silo), the Key Distribution Center (KDC) evaluates the policy's access-control conditions at ticket-request time. A device-constrained policy says, in effect, "issue a Ticket-Granting Ticket (TGT) for this account only if the authenticating device presents membership in the Tier 0 device group," carried via Kerberos compound authentication, which requires armoring (FAST). So a TGT lifted from a Tier 2 host and replayed from there fails the condition and the KDC refuses it. This is why a silo is a real boundary and Protected Users is not: Protected Users changes what credential material exists, while the silo changes where a credential is honored.
The deny-logon matrix
The five "Deny log on…" rights, applied to tier admin groups through each tier's Organizational Unit (OU), form a grid:
| Account group | Tier 0 hosts | Tier 1 hosts | Tier 2 hosts |
|---|---|---|---|
| Tier 0 admins | Allow | Deny (all 5) | Deny (all 5) |
| Tier 1 admins | Deny | Allow | Deny |
| Tier 2 / users | Deny | Deny | Allow |
The point of denying all five rights (locally, RemoteInteractive, network, batch, service) is that attackers and sloppy operations find the unusual ones, a Tier 0 service account quietly running a scheduled task on a Tier 1 box exposes its credential just as surely as an interactive logon. Because deny overrides allow, test the matrix so you don't lock legitimate Tier 0 admins out of Tier 0 hosts.
Where credentials still land, and what catches them
Even with Privileged Access Workstations (PAWs) and silos, Single Sign-On (SSO) means secrets live in memory during legitimate use. The layered answer:
- Credential Guard isolates NT LAN Manager (NTLM) hashes and Kerberos tickets/keys in a Virtualization-Based Security (VBS) enclave, so a normal memory dump yields nothing usable.
- Local Security Authority (LSA) Protection (RunAsPPL) stops untrusted code tampering with the LSA process.
- Protected Users means there's no NTLM hash and only a short TGT to begin with.
- Short TGT lifetimes (Protected Users' 4 hours, or shorter via policy) limit how long a stolen ticket is useful.
None of these stops a live attacker using an active session or a keylogger on a dirty host, which is why the PAW (clean device) and Just-In-Time (JIT) (no standing credential) remain the primary controls; these are the layer underneath.
Common misconceptions
| Misconception | Reality |
|---|---|
| "Protected Users is a boundary." | It reduces loot and shelf life; the boundary is the silo + deny-logon. |
| "We turned silos on." | Only binding if policies are in enforce mode, every account/Domain Controller (DC) is enrolled, and armoring is end-to-end. |
| "Local Administrator Password Solution (LAPS) means local admin is solved." | Only if read rights are tightly scoped and encryption is on; broad read = shared secret again. |
| "We have Privileged Identity Management (PIM), so JIT is done." | Only for roles actually converted to eligible, and only if activation needs phishing-resistant Multi-Factor Authentication (MFA) + a compliant device. |
| "Credential Guard replaces tiering." | Defense-in-depth on member hosts; it doesn't stop live-session abuse and isn't a boundary. |
| "A jump box is a PAW." | A PAW is single-purpose and never does risky activity; a shared jump host is a bigger target. |
Troubleshooting the rollout
- "Silos broke half our logons." Almost always Kerberos armoring not deployed end-to-end. Roll out the KDC and Kerberos-client armoring Group Policy Object (GPO) settings first, run the policy in audit mode, then enforce.
- "Adding accounts to Protected Users broke a service." That account shouldn't be there, Protected Users is user-accounts-only. Use group Managed Service Account (gMSA) + silo + logon rights for service/computer accounts.
- "PIM activation keeps failing." Usually a Conditional Access policy firing an MFA challenge during activation; reconcile the activation flow with your Conditional Access design.
- "We're worried about lockout." Stand up and test break-glass accounts before enforcing anything; exclude them from Conditional Access and PIM.
Attacker's view
AttackerIn Part 1 the attacks exploited the absence of tiering. Here they exploit the incomplete implementation of it, which, in the real world, is far more common. Each technique targets a specific gap: an account left out of a control, a boundary left in audit mode, standing privilege never removed, a good control (LAPS) made dangerous by loose permissions, or the one thing user-account hardening can't cover (machine-account relay). The commands are recognition- and audit-level only.
Exploiting Protected Users exclusions (service accounts, Relative Identifier (RID) 500, break-glass)ATT&CKT1550.002 Pass the Hash · T1078 Valid Accounts
The attacker ignores the hardened accounts and targets the ones deliberately or accidentally left out of Protected Users: service accounts (which can't be members), the built-in Administrator (RID 500, only partially covered), or a break-glass account whose NT LAN Manager (NTLM) hash and long-lived ticket are still stealable.
Risk: A privileged account not in Protected Users with a reachable, resident credential, e.g. a service account on a server the attacker holds.
Environments that added Domain Admins (DA) accounts to Protected Users but left Tier 0 service accounts, the RID 500 admin, or numerous 'exception' accounts outside it, keeping NTLM hashes and cached creds alive.
Mimikatz / Impacket (dump and pass the excluded account's hash), BloodHound (flag privileged accounts not covered), NetExec.
# Recognition: which privileged accounts are not in Protected Users?
Get-ADGroupMember 'Protected Users' | measure # compare against the privileged setVerify: NTLM authentication (4624 type 3 / 4776) by a privileged account that should be AES-only, and use of excluded service/RID 500 accounts from unexpected hosts.
Reported as 'hardening with gaps': severity driven by the rights of the excluded account. Impact: the control is bypassed entirely via the weakest covered-in-name-only account. Retest: Verify: every privileged user account in Protected Users; service accounts moved to group Managed Service Account (gMSA) and constrained by silo/logon rights.
Administering from a dirty workstation (Privileged Access Workstation (PAW) bypass)ATT&CKT1078.002 Valid Accounts · T1056.001 Keylogging · T1557 Adversary-in-the-Middle
The attacker doesn't break the PAW, they wait for an admin who uses a privileged account from a non-PAW device, or on a 'PAW' that is also allowed to browse the web and read email, and harvest the credential from that dirty host.
Risk: A privileged logon from a device that also performs risky activities (email, web, arbitrary apps).
PAW programs that are incomplete (admins still have a path to log on from their normal laptop), 'soft' PAWs without application control or network restriction, or shared jump hosts everyone Remote Desktop Protocols (RDPs) through with privileged accounts.
Standard infostealer/keylogger tooling and session hijacking once on the dirty host; BloodHound sessions reveal where privileged logons actually occur.
# Recognition: where do privileged accounts actually log on?
# Event 4624 by privileged account, group by source host; flag non-PAW sourcesVerify: Privileged logons (4624) originating from non-PAW devices, PAWs with outbound web traffic or installed productivity apps, and Conditional Access sign-ins from non-compliant devices.
A clean-source violation that nullifies the rest of the stack. Severity: high to critical depending on the account. Retest: Verify: privileged logons occur only from compliant PAWs (device-based authentication policy + Conditional Access enforce it), PAWs locked down with Windows Defender Application Control (WDAC) and network allow-listing.
Silo and armoring gaps (audit mode, missing members, no Flexible Authentication Secure Tunneling (FAST))ATT&CKT1550.003 Pass the Ticket · T1484 Domain Policy Modification
The attacker finds where the boundary isn't actually enforcing: an authentication policy left in audit-only mode, a Domain Controller (DC) or admin account not in the silo, or Kerberos armoring not deployed end-to-end so the policy can't apply, and replays a ticket through the gap.
Risk: A privileged account or DC outside the enforcing silo, or a policy not in enforce mode.
Half-rolled-out silos (common, because armoring breaks non-FAST clients), policies stuck in audit mode 'temporarily,' and DCs that don't have the Key Distribution Center (KDC) armoring Group Policy Object (GPO) applied.
Rubeus / Impacket (request and replay tickets), BloodHound and PowerShell to enumerate silo membership and policy assignment, PingCastle for posture.
# Recognition: which privileged accounts/DCs are outside the silo?
Get-ADAuthenticationPolicySilo -Filter * ; Get-ADUser -LDAPFilter '(msDS-AssignedAuthNPolicySilo=*)'Verify: Tickets issued to siloed accounts from non-silo devices succeeding (policy in audit mode logs but doesn't deny), and armoring-not-available events on DCs.
Severity driven by which accounts the gap exposes. Impact: the strongest native boundary is present but non-binding. Retest: Verify: policies in enforce mode, every Tier 0 account and DC in the silo, armoring confirmed end-to-end via a replay attempt that is denied.
Standing privilege and Privileged Identity Management (PIM) activation abuseATT&CKT1078.004 Cloud Accounts · T1098 Account Manipulation
Either the organization never removed standing privilege (so there's always a live admin credential to steal), or it uses PIM but the activation path is weakly protected, letting an attacker with a phished session or token simply activate the role themselves.
Risk: A standing privileged role, or a PIM activation path not gated by phishing-resistant Multi-Factor Authentication (MFA) and a compliant device.
Permanent Global Admin / Domain Admin assignments, PIM without Conditional Access device requirements, activation protected only by push MFA (phishable), and no approver on the highest roles.
Token-theft and Adversary-in-the-Middle (AITM) phishing kits (Evilginx-style) to capture a session, then native portals/Application Programming Interfaces (APIs) to activate; BloodHound/AzureHound to find standing and eligible privilege.
# Recognition: how much standing privilege exists?
# Entra: list permanent vs eligible role assignments; flag permanent Global AdminsVerify: PIM activations from non-compliant devices or without strong MFA, role activations immediately after a token-theft sign-in, and any permanent high-privilege assignment.
Ties Just-In-Time (JIT) quality to real risk. Severity: critical for control-plane roles. Retest: Verify: near-zero standing privilege, activation requires phishing-resistant MFA + compliant Privileged Access Workstation (PAW) + approval, break-glass accounts monitored.
Reading Local Administrator Password Solution (LAPS) passwords (over-broad rights, legacy cleartext)ATT&CKT1552 Unsecured Credentials · T1078.003 Local Accounts
LAPS is deployed, but the attacker can read the stored local-admin passwords because read rights on the LAPS attribute are too broad, or legacy LAPS stored them in a cleartext attribute, turning a per-machine secret back into a mass credential source.
Risk: Read access to the LAPS password attribute for many machines (an over-permissioned group, or a compromised account that holds it).
Delegations that grant help-desk or broad groups read on the LAPS attribute, legacy Microsoft LAPS without encryption, and Entra LAPS without tight role-based read scoping.
LAPSToolkit / PowerView and native Lightweight Directory Access Protocol (LDAP) queries to read the attribute; BloodHound surfaces who can read it.
# Recognition: who can read the LAPS password attribute?
# Audit read ACLs on ms-Mcs-AdmPwd / msLAPS-Password across the OU treeVerify: Bulk reads of the LAPS password attribute (directory access auditing), and legacy cleartext attributes still present.
Turns a good control into a liability. Severity: high (fleet-wide local admin). Retest: Verify: LAPS read restricted to the minimum Tier-appropriate admins, encryption enabled (2016 Domain Functional Level (DFL)), reads audited and alerted, legacy LAPS retired.
Coercion and relay despite account hardeningATT&CKT1557.001 LLMNR/NBT-NS or AD CS relay · T1187 Forced Authentication
The account controls don't cover computer accounts, so the attacker coerces a privileged machine (a Domain Controller (DC), or a host) into authenticating and relays that machine account, the same engine behind the Active Directory (AD) CS ESC8/ESC11 attacks, since Protected Users and silos protect users, not the machine's own forced authentication.
Risk: A coercible privileged machine and a relay target that accepts it (e.g. AD CS web enrollment without channel binding).
Environments that hardened user accounts but left coercion open (no Remote Procedure Call (RPC) filters/patches), and relay targets without signing/Extended Protection for Authentication (EPA), regardless of how well admin users are protected.
Coercer / PetitPotam (recognition of coercion surface), ntlmrelayx for the relay; this is the Part-1 'relay as the coerced machine' and the AD CS series' ESC8/ESC11.
# Recognition: is coercion reachable and are relay targets protected?
# Check EPA/signing on AD CS web enrollment; test MS-EFSRPC/MS-RPRN coercion surfaceVerify: Machine-account authentications to unexpected relay targets, AD CS enrollment on behalf of a DC's machine account, and coercion RPC calls.
Explains why user-account hardening isn't the whole story. Severity: critical (machine-account relay can reach Tier 0). Retest: Verify: coercion patched/filtered, relay targets enforce signing/EPA, AD CS hardened, cross-referenced with the AD CS remediation.
Defender's playbook
DefenderThis is the heart of Part 2: the ordered implementation. The sequencing follows Rapid Modernization Plan (RaMP), stop new risk first, then clean up, so protection starts in week one. Everything here enforces the Part 1 cardinal rule; the difference is these are concrete switches you throw.
Quick wins (days)
- Stand up break-glass accounts first. At least two cloud-only Global Admin (and on-prem Domain Admin) accounts, Fix: excluded from Conditional Access and Privileged Identity Management (PIM), credentials split and stored offline, and alert on any sign-in. Do this before tightening anything else.
- Protected Users for every admin user account. Free, fast, high-impact, no NT LAN Manager (NTLM), AES-only, 4-hour Ticket-Granting Ticket (TGT). Generate Advanced Encryption Standard (AES) keys first (reset the password against a modern Domain Controller (DC)), and keep service accounts and one break-glass account out.
Add-ADGroupMember "Protected Users" -Members adm0-jordan,adm1-jordan - Deploy the deny-logon matrix. Group Policy Objects (GPOs) denying Tier 0/Tier 1 admin groups all five logon rights on lower-tier Organizational Units (OUs). Works on every host, no prerequisites.
- Turn on Windows Local Administrator Password Solution (LAPS). Built-in since April 2023; give every machine a unique rotated local password and Fix: scope read access to the minimum Tier-appropriate admins. Enable encryption (2016 Domain Functional Level (DFL)). Retire legacy LAPS.
- Inventory standing privilege. List permanent Global Admin / Domain Admin assignments; this is the backlog Just-In-Time (JIT) will remove.
Longer-term fixes (weeks to months)
- Remove standing privilege with JIT. Make admins eligible via PIM (cloud) and time-boxed group membership or a Privileged Access Management (PAM) tool (on-prem). Fix: Gate activation with phishing-resistant Multi-Factor Authentication (MFA), approval for top roles, and a compliant-device requirement.
- Deploy Privileged Access Workstations (PAWs), tier by tier. Start with Tier 0 admins: hardware root of trust (Trusted Platform Module (TPM), Secure Boot), Intune-managed, Windows Defender Application Control (WDAC) allow-listing, network restricted to management endpoints, provisioned from a clean source.
- Enforce the silo boundary. Deploy Kerberos armoring end-to-end, build the Tier 0 silo (accounts + PAWs + DCs), run policies in audit then Fix: enforce, with device-based conditions ("Tier 0 accounts only from PAWs").
- Turn on Credential Guard + Local Security Authority (LSA) Protection across the estate as defense-in-depth (default-on where hardware allows).
- Convert Tier 0 service accounts to group Managed Service Account (gMSA), constrained by silo and logon rights, since they can't use Protected Users.
- Stand up drift monitoring (next section) and fold it into the Security Operations Center (SOC).
Detection signals
| Event or signal | Source | Alert on |
|---|---|---|
| Siloed account ticket from a non-silo device | DC / Key Distribution Center (KDC) | Verify: A Tier 0 account authenticating from outside its silo (boundary probe or misconfig) |
| 4625 / 4776 NTLM by a Protected Users member | DC / host | NTLM attempted by an account that should be AES-only, misconfig or attack |
| Changes to auth policies / silos | DC Security log (5136) | A policy flipped to audit, or an account/DC removed from a silo |
| 4728 / 4732 / 4756 on Tier 0 groups | DC Security log | New standing privilege granted (drift away from JIT) |
| PIM activation events | Entra audit log | Activation from a non-compliant device or without strong MFA; any break-glass sign-in |
| Bulk reads of the LAPS password attribute | DC directory-access audit | Over-broad or anomalous LAPS reads |
| PAW compliance / config deviation | Microsoft Intune (Intune) / Microsoft Defender for Endpoint (MDE) | A PAW with web traffic, new apps, or non-compliant state |
| Kerberos armoring (FAST) failures | DC | Clients unable to armor, which silos depend on |
Verify the fix worked
- Verify: Attempt to replay a Tier 0 account's ticket from a non-silo host and confirm the KDC denies it; confirm policies are in enforce, not audit, mode.
- Enumerate the privileged set and confirm every user account is in Protected Users (and every service account is a gMSA in a silo).
- Pull privileged logon events and confirm they originate Verify: only from compliant PAWs; confirm PAWs have no web/email path.
- Confirm standing privilege is near zero and PIM activation requires phishing-resistant MFA + a compliant device.
- Confirm LAPS read access is scoped and audited, and that a stolen local hash fails on a second machine.
- Test the break-glass accounts actually work, and that using one fires an alert.
Why remediation stalls, and workable compromises
| Objection | Workable compromise |
|---|---|
| "Silos broke everything last time." | Deploy armoring first, run in audit mode, start with the small Tier 0 silo, then enforce; Fix: nothing breaks by surprise. |
| "We can't buy every admin a second laptop yet." | Start PAWs with Tier 0 admins only; use a Virtual Desktop Infrastructure (VDI)/Cloud PC privileged session as an interim clean source. |
| "Protected Users will break our service accounts." | Don't put them in it; convert to gMSA and constrain with silo + logon rights instead. |
| "Full JIT for on-prem is hard." | Do cloud roles with PIM now; use time-boxed group membership / a PAM tool for on-prem, and at least stop issuing new standing admin. |
| "Entra P2 isn't budgeted this year." | Do the free wins now (Protected Users, deny-logon, LAPS, break-glass); stage PIM when licensing lands. |
| "This could lock us out." | Break-glass accounts first, tested; audit-mode everything before enforce; roll out tier by tier. |
Executive brief
ExecutiveThe risk in plain language
Part 1 showed why one hacked laptop can take down the whole company, and that the fix is keeping our most powerful credentials off ordinary machines. This part is the how and the when. The reassuring part: the highest-impact steps are Fix: built-in features and policy changes, not new purchases, and they land in the first few weeks. The investment pieces, dedicated hardened admin laptops and a just-in-time access system, come after, phased so we're safer immediately rather than only at the end.
Business impact
- Finishing this closes the standard path attackers use for Risk: company-wide ransomware: steal a powerful credential, reuse it everywhere.
- Just-in-time access means that, most of the time, Fix: there is no active super-user credential in the environment to steal at all.
- It's sequenced to Fix: reduce real risk in week one, not after a multi-year project, which is how the last generation of "admin forest" programs failed.
What drives likelihood
- Admins using powerful accounts on their everyday laptops (the single biggest exposure).
- Permanent super-user rights left switched on when nobody's using them.
- Half-finished controls, a boundary in "monitor only," an account left out, a "Privileged Access Workstation (PAW)" that still browses the web.
- A shared local password across machines (fixed free with the built-in tool).
Cost of inaction
The free controls alone remove most of the easy paths; skipping them leaves Risk: a one-click route from a laptop to total control open for no good reason. The paid pieces, hardened admin laptops and the higher-tier identity licence for just-in-time access, are modest against the cost of a domain-wide outage, and can be phased to our most powerful admins first. The real risk of delay is that Risk: each new system stood up the old way adds more standing privilege to clean up later.
What good looks like
- Administrators work from Fix: dedicated, locked-down machines; no powerful account ever touches email or the web.
- Super-user access is Fix: granted for a few hours when needed, with approval, not held permanently.
- Powerful credentials Fix: stop working the moment they leave their home turf (the boundary controls).
- A couple of closely-watched Fix: emergency accounts guarantee we can never lock ourselves out, and a live dashboard shows standing privilege near zero with any boundary violation caught.
Questions executives ask
We know the tiering plan from Part 1. What does actually implementing it cost and take?
"The first protections are fast and mostly free, built-in Windows features and policy: hardened admin accounts, logon restrictions and the free local-password tool land in the first weeks. The investment is the hardened admin laptops and the just-in-time access system, which carry some licensing and effort. Fix: We sequence it so we're safer in week one, not only at the end, using Microsoft's rapid modernization plan as the roadmap."
What is a 'privileged access workstation' and why can't admins just use their normal laptops?
"A privileged access workstation is a locked-down machine used only for administration, no email, no web browsing. The reason is simple: the credential is only as safe as the device it's typed on. An admin's everyday laptop opens attachments and visits websites, so it's exactly where an attacker gets in. Keeping the powerful credentials on a clean, single-purpose machine removes that exposure."
You mentioned removing 'standing' admin rights. Won't that slow our admins down?
"Only slightly, and the payoff is large. Instead of a handful of people being permanent administrators, they become eligible and switch the role on for a few hours when they need it, with a second factor and a reason logged. Fix: Most of the time there is no active admin credential to steal, which closes the attacker's favourite door. Day to day it's one extra approval step."
If we lock all this down, what stops us from locking ourselves out?
"We build that safety in first. A small number of tightly-controlled 'break-glass' accounts are deliberately kept outside the automated controls and stored securely offline, so if the new system ever fails we can still get in. Fix: They're monitored so closely that any use pages the security team immediately. Microsoft's roadmap actually makes these emergency accounts step one, before anything else."
Does this need new licences or products?
"Some of it. The admin-account hardening, logon restrictions and local-password tool are built into Windows at no extra cost. The just-in-time access service for cloud roles needs a higher-tier identity licence (Entra ID P2), and the hardened admin laptops are a hardware and management cost. Fix: We can stage the paid pieces after the free wins, so value starts immediately."
How will we know it's actually working and staying in place?
"Two measures. First, the amount of standing admin access, which should fall toward zero as just-in-time takes over. Second, tier-boundary violations, attempts to use a powerful credential where it doesn't belong, which our monitoring flags. Verify: A healthy environment shows near-zero standing privilege and any boundary violation caught and investigated. We review both on a dashboard, because this is a state to maintain, not a one-time project."
Presenting this finding to leadership
- Headline: "We have the plan from Part 1; here's the rollout, and Fix: most of the first wins are free and land in weeks."
- Show the sequence: free built-in controls and emergency accounts first, then just-in-time access, then the hardened admin laptops, safer at every step.
- Name the two metrics: standing super-user access (drive to near zero) and tier-boundary violations caught, on an ongoing dashboard.
- The ask: approve the free rollout now; budget the admin laptops and the P2 licence for our most powerful admins first, then widen.
Talk the talk
Jargon decoder
A hardened, single-purpose workstation used only for privileged admin.
"Do the Domain Controller (DC) work from your PAW, not your email laptop."
A built-in group whose members get non-configurable credential protections (no NT LAN Manager (NTLM), AES-only, 4-hour Ticket-Granting Ticket (TGT), no delegation, no caching).
"Put every admin account in Protected Users, but keep break-glass out."
A rule setting an account's Ticket-Granting Ticket (TGT) lifetime and the conditions under which it can authenticate.
"The policy gives Tier 0 accounts a one-hour ticket and only from a Privileged Access Workstation (PAW)."
A container confining privileged accounts, devices and services to each other, enforced by the Key Distribution Center (KDC).
"The Domain Admins (DA)'s ticket won't issue outside the Tier 0 silo."
A protected pre-authentication channel that silos and policies depend on.
"Silos broke until we rolled out armoring to all the clients."
Group Policy that denies specified accounts the right to log on to hosts in an Organizational Unit (OU).
"The deny-logon matrix stops a Domain Admins (DA) logging on to any workstation."
Built-in Windows feature giving each machine a unique, rotated local admin password.
"LAPS means that stolen local hash is useless on the next box."
Admin rights that are permanently assigned rather than activated on demand.
"Drive standing privilege toward zero with Privileged Identity Management (PIM)."
Eligible = allowed to activate a role; active = currently holding it.
"She's eligible for Domain Admin but not active until she elevates."
A tightly-controlled emergency account kept outside the automated controls.
"If Privileged Identity Management (PIM) is down, we use a break-glass account, and everyone gets paged."
VBS-based isolation that keeps secrets out of reach of even local admin.
"Credential Guard means the memory dump came back useless."
Running the LSA process as protected (RunAsPPL) so untrusted code can't tamper with it.
"Turn on LSA Protection alongside Credential Guard."
Rapid Modernization Plan (RaMP)'s Enterprise / Specialized / Privileged tiers of access protection.
"Control-plane admin is the Privileged level; apply the strongest controls."
Microsoft's rapid modernization plan: the sequenced rollout of privileged-access controls.
"RaMP says stop new standing admin before cleaning up the old."
Smart questions to ask
Sysadmins
- Is every privileged user account in Protected Users, and is every service account a group Managed Service Account (gMSA) (not in Protected Users)?
- Are the authentication-policy silos in Risk: enforce mode, with every Tier 0 account and Domain Controller (DC) enrolled and armoring end-to-end?
- Do privileged logons originate Verify: only from compliant Privileged Access Workstations (PAWs), and do those PAWs have no web/email path?
- Is Privileged Identity Management (PIM) activation gated by Fix: phishing-resistant Multi-Factor Authentication (MFA) and a compliant device, and how much standing privilege remains?
- Are Local Administrator Password Solution (LAPS) read rights Risk: tightly scoped and audited, with encryption on?
Executives
- Can we Verify: prove no powerful credential works from an ordinary machine, by testing, not just policy?
- Is super-user access granted on demand or held permanently?
- Do we have tested Fix: emergency accounts so hardening can't lock us out?
Coworkers
- Is this control actually enforcing or just configured (enforce vs audit, enrolled vs excluded)?
- Did we test the Risk: excluded accounts, service accounts, Relative Identifier (RID) 500, break-glass?
- Is the finding a user-account issue or a Risk: machine-account relay (which Protected Users/silos don't cover)?
Say this, not that
"We put the admins in Protected Users, so credential theft is handled."
"Protected Users reduces the loot, but it's not a boundary, and it misses service accounts and Relative Identifier (RID) 500; we still need silos and deny-logon."
"The admins have a jump box, that's our Privileged Access Workstation (PAW)."
"A shared jump box everyone Remote Desktop Protocols (RDPs) through isn't a PAW; a PAW is single-purpose, locked down, and never browses the web."
"We turned on silos."
"Are the policies in enforce mode, is every Tier 0 account and Domain Controller (DC) in the silo, and is armoring deployed end-to-end? Half-on is non-binding."
"We deployed Local Administrator Password Solution (LAPS), local admin is sorted."
"Only if read access is tightly scoped and encryption's on, over-broad read rights turn LAPS back into a shared secret."
"We use Privileged Identity Management (PIM), so we have just-in-time."
"Good, but is activation gated by phishing-resistant Multi-Factor Authentication (MFA) and a compliant Privileged Access Workstation (PAW)? Otherwise a phished session just activates the role."
"Credential Guard protects the domain controllers' credentials."
"Credential Guard helps on member hosts, but it doesn't run on Domain Controllers (DCs) the same way and isn't a substitute for tiering, it's defense in depth."
"Let's lock everything down this weekend."
"We stand up break-glass accounts first and stage armoring and silos, or we'll lock ourselves out, that's why Rapid Modernization Plan (RaMP) sequences it."
Same point, two audiences
"A master key is only as safe as the person carrying it; we give admins a clean, single-purpose machine to carry it on."
"Privileged logons only from a compliant Privileged Access Workstation (PAW), enforced by a device-based authentication policy and Conditional Access."
"Instead of permanent administrators, people switch the power on for a few hours when needed, with approval, so most of the time there's nothing to take."
"Eligible-not-active via Privileged Identity Management (PIM); drive standing privilege toward zero; on-prem Just-In-Time (JIT) via time-boxed group membership or a Privileged Access Management (PAM) tool."
"We set up a couple of closely-watched emergency accounts first, so hardening everything else can't lock us out."
"Two cloud-only break-glass Global Admins excluded from Certificate Authority (CA) and Privileged Identity Management (PIM), stored offline, alert on any sign-in, rotate after use."
"A lock that's only partly installed still lets people in; we verify each control is actually enforcing, not just switched on."
"Policies in enforce (not audit) mode, every privileged account enrolled, armoring end-to-end, and alerting on any exclusion."
Keep going
What to learn next, in order
- Microsoft's Rapid Modernization Plan (RaMP) and "securing privileged access" docs. The authoritative, step-by-step rollout, with the Enterprise/Specialized/Privileged security levels and the implementation phases.
- Privileged Access Workstation (PAW) deployment guidance (Microsoft + Microsoft Intune (Intune)). The concrete build: hardware requirements, Windows Defender Application Control (WDAC)/AppLocker, Conditional Access for device-based admin access.
- Authentication Policies and Silos hands-on. Kerberos armoring (FAST), audit-then-enforce, and the Active Directory Administrative Center (ADAC)/PowerShell workflow, best practised in a lab forest.
- Entra Privileged Identity Management (PIM) configuration. Eligible assignments, approval workflows, activation Multi-Factor Authentication (MFA) and Conditional Access, plus break-glass exclusions.
- The Active Directory (AD) CS abuse series. The ESC8/ESC11 relay story behind the "coercion despite account hardening" attack, and why the Certificate Authority (CA) belongs in your Tier 0 silo.
Resources worth seeking out
- Microsoft Learn: "Securing privileged access," the RaMP page, Protected Users, Authentication policies and silos, Windows Local Administrator Password Solution (LAPS), and Credential Guard, the primary sources for every control here.
- The BloodHound / SpecterOps material for testing whether your enforcement actually binds (path analysis, session and silo enumeration).
- An authorized lab forest to deploy armoring, silos and PIM safely, with break-glass tested, before touching production.
AD tiering & privileged access design
Acronyms
Every acronym used on this page. Four test modes are below the table.
| Acronym | Expansion | Plain English | Why it matters |
|---|---|---|---|
| ACL | Access Control List | The list of permissions on an object or attribute. | Over-broad read Access Control Lists (ACLs) on the Local Administrator Password Solution (LAPS) password attribute re-create a shared-secret problem. |
| AD | Active Directory | Microsoft's on-prem directory and identity system for Windows domains. | Part 2 is the hands-on hardening of Active Directory (AD) admin access: Privileged Access Workstations (PAWs), silos, Protected Users and Just-In-Time (JIT). |
| ADAC | Active Directory Administrative Center | The GUI console for managing Active Directory (AD), including authentication policies and silos. | Authentication policies and silos are created and assigned in Active Directory Administrative Center (ADAC) (or via PowerShell). |
| AES | Advanced Encryption Standard | The modern symmetric cipher Kerberos uses for strong encryption. | Protected Users forbids weak ciphers, so Advanced Encryption Standard (AES) keys must exist for members before they're added. |
| AITM | Adversary-in-the-Middle | An attack that relays a victim's authentication through the attacker in real time. | Adversary-in-the-Middle (AITM) phishing kits capture a session/token, which can then activate a weakly-gated Privileged Identity Management (PIM) role. |
| API | Application Programming Interface | A programmatic interface to a service. | After token theft, an attacker can activate roles via portals or the directory Application Programming Interface (API). |
| CA | Certificate Authority | The server that issues digital certificates. | The enterprise Certificate Authority (CA) is a Tier 0 asset (the Active Directory (AD) CS series): it belongs in the Tier 0 silo and Privileged Access Workstation (PAW) scope too. |
| CFO | Chief Financial Officer | The executive responsible for an organization's finances. | The Chief Financial Officer (CFO) weighs the cost of Privileged Access Workstations (PAWs) and the P2 licence against domain-wide ransomware risk. |
| CISO | Chief Information Security Officer | The executive accountable for an organization's security. | The Chief Information Security Officer (CISO) owns the Rapid Modernization Plan (RaMP) sequencing decisions and the operational-friction tradeoffs this part raises. |
| DA | Domain Admins | The Active Directory (AD) group with full control of a domain. | The Domain Admins (DA) accounts are the first you place in Protected Users and a Tier 0 silo, and the first to move to Just-In-Time (JIT). |
| DC | Domain Controller | A server that hosts the Active Directory (AD) database and authenticates the domain. | Domain Controllers (DCs) are the Tier 0 asset these controls protect, and the Key Distribution Center (KDC) that enforces silos runs on them. |
| DCSync | Directory replication abuse | Impersonating a Domain Controller (DC) to pull password hashes via the replication protocol. | Even with these controls, an account left with replication rights remains a hidden Tier 0 path (Part 1). |
| DES | Data Encryption Standard | An obsolete, weak symmetric cipher. | Protected Users blocks Data Encryption Standard (DES) (and Rivest Cipher 4 (RC4)) for Kerberos, forcing Advanced Encryption Standard (AES). |
| DFL | Domain Functional Level | The feature baseline a domain runs at, set by its oldest supported Domain Controller (DC) version. | Forest authentication policies need a 2012 R2 Domain Functional Level (DFL); Windows Local Administrator Password Solution (LAPS) password encryption needs a 2016 DFL. |
| EA | Enterprise Admins | The Active Directory (AD) group with full control across every domain in a forest. | Enterprise Admins (EA) accounts need the same Tier 0 silo, Privileged Access Workstation (PAW) and Just-In-Time (JIT) treatment as Domain Admins (DA), at forest scope. |
| EAM | Enterprise Access Model | Microsoft's control/management/data-plane model that superseded the tier model. | These controls implement Enterprise Access Model (EAM)'s control plane: protect, isolate and time-limit privileged access. |
| EDR | Endpoint Detection and Response | Software that detects and investigates endpoint threats. | Endpoint Detection and Response (EDR) catches the credential-theft and lateral-movement behavior that slips past preventive controls. |
| EPA | Extended Protection for Authentication | Channel binding that ties authentication to the TLS session, defeating relay. | Relay targets like Active Directory (AD) CS web enrollment must enforce signing/Extended Protection for Authentication (EPA) to stop machine-account relay. |
| ESAE | Enhanced Security Administrative Environment | Microsoft's retired hardened administrative-forest design (the Red Forest). | Rapid Modernization Plan (RaMP) and these controls are the lighter, cloud-aware replacement Microsoft now recommends over Enhanced Security Administrative Environment (ESAE). |
| FAST | Flexible Authentication Secure Tunneling | Kerberos armoring: a protected channel for pre-authentication. | Authentication policy silos require Kerberos armoring (FAST) to be enabled on Domain Controllers (DCs) and clients. |
| FIDO2 | Fast Identity Online 2 | A phishing-resistant, public-key authentication standard. | Fast Identity Online 2 (FIDO2) security keys are the recommended phishing-resistant Multi-Factor Authentication (MFA) for privileged accounts and Privileged Access Workstation (PAW) logon. |
| FSMO | Flexible Single Master Operations | The special Active Directory (AD) roles held by particular Domain Controllers (DCs). | Protected Users protections require the PDC-emulator Flexible Single Master Operations (FSMO) role to run on Windows Server 2012 R2 or later. |
| gMSA | group Managed Service Account | An AD-managed service account with an automatically rotated password. | Move Tier 0 service accounts to group Managed Service Accounts (gMSAs) so there is no static, stealable service password. |
| GPO | Group Policy Object | A set of Windows and Active Directory (AD) settings applied to Organizational Units (OUs). | The cardinal rule is enforced technically with Deny log on Group Policy Objects (GPOs) linked to each tier's Organizational Units (OUs). |
| Intune | Microsoft Intune | Microsoft's cloud device-management service. | Microsoft Intune (Intune) enrolls, hardens and monitors Privileged Access Workstations (PAWs) and pushes their restrictive configuration profiles. |
| IR | Incident Response | The process of investigating and containing a security incident. | Break-glass accounts and silo logs are what Incident Response (IR) relies on during a suspected Tier 0 compromise. |
| JEA | Just Enough Administration | A PowerShell feature that constrains what an admin session can do. | Just Enough Administration (JEA) lets operators run specific admin tasks without full local admin, shrinking Tier 1/2 exposure. |
| JIT | Just-In-Time | Granting privilege only for a limited, approved window. | Just-In-Time (JIT) removes standing admin rights so that most of the time there is no privileged credential to steal. |
| KDC | Key Distribution Center | The Kerberos service on a Domain Controller (DC) that issues tickets. | The Key Distribution Center (KDC) enforces authentication-policy silos: it will only issue tickets to silo members from allowed hosts. |
| LAPS | Local Administrator Password Solution | A tool that sets a unique, rotated local admin password per machine. | Windows Local Administrator Password Solution (LAPS) (built in since the April 2023 update) kills the shared local-admin hash that enables fleet-wide pass-the-hash. |
| LDAP | Lightweight Directory Access Protocol | The protocol used to query and modify Active Directory (AD). | Attackers read Local Administrator Password Solution (LAPS) passwords and enumerate silo membership via Lightweight Directory Access Protocol (LDAP) queries. |
| LLMNR | Link-Local Multicast Name Resolution | A legacy name-resolution protocol often abused for credential capture. | Link-Local Multicast Name Resolution (LLMNR)/NBT-NS poisoning and coercion feed the relay that user-account hardening doesn't cover. |
| LSA | Local Security Authority | The Windows subsystem that handles authentication and local security policy. | Local Security Authority (LSA) Protection (RunAsPPL) stops untrusted code tampering with the process that holds credentials. |
| LSASS | Local Security Authority Subsystem Service | The Windows process that stores credentials and secrets in memory. | Credential Guard moves Local Security Authority Subsystem Service (LSASS) secrets into an isolated Virtualization-Based Security (VBS) enclave so even local admin can't read them. |
| MDE | Microsoft Defender for Endpoint | Microsoft's endpoint detection and response platform. | Microsoft Defender for Endpoint (MDE) on the Privileged Access Workstation (PAW) and on Tier 0 hosts provides the monitoring the whole privileged-access design relies on. |
| MFA | Multi-Factor Authentication | Requiring more than a password to authenticate. | Phishing-resistant Multi-Factor Authentication (MFA) gates Privileged Identity Management (PIM) activation and admin sign-in to the Privileged Access Workstation (PAW). |
| NTLM | NT LAN Manager | A legacy Windows challenge-response authentication protocol. | Protected Users blocks NT LAN Manager (NTLM) for members, removing the hash that pass-the-hash relies on. |
| OS | Operating System | The core software that runs a computer. | Credential Guard holds secrets in a Virtualization-Based Security (VBS) enclave the normal Operating System (OS) cannot reach. |
| OU | Organizational Unit | A container in Active Directory (AD) used to group objects and apply policy. | Deny-logon Group Policy Objects (GPOs) and the tier structure are applied through a Tier 0/1/2 Organizational Unit (OU) design. |
| PAM | Privileged Access Management | A category of tools that broker, vault and record privileged sessions. | On-prem Just-In-Time (JIT) (temporary group membership, session brokering) is delivered by a Privileged Access Management (PAM) tool or MIM. |
| PAW | Privileged Access Workstation | A hardened, single-purpose device used only for privileged administration. | The Privileged Access Workstation (PAW) is the clean source made real: the only device a Tier 0 credential is allowed to appear on. |
| PDC | Primary Domain Controller | The Domain Controller (DC) holding the PDC-emulator role (time, lockout and compatibility master). | The Primary Domain Controller (PDC) emulator's Operating System (OS) version gates whether the Protected Users and silo protections are available. |
| PIM | Privileged Identity Management | Microsoft Entra's just-in-time role activation service. | Privileged Identity Management (PIM) delivers eligible-not-active roles with approval, Multi-Factor Authentication (MFA) and time limits; it needs an Entra ID P2 license. |
| PtH | Pass-the-Hash | Reusing a stolen NT LAN Manager (NTLM) password hash to authenticate without the plaintext. | Protected Users (no NT LAN Manager (NTLM)) and Credential Guard (no readable hash) are the direct counters to pass-the-hash. |
| PtT | Pass-the-Ticket | Reusing a stolen Kerberos ticket to authenticate as its owner. | A silo limits where a ticket is valid, and a short Ticket-Granting Ticket (TGT) limits how long a stolen one is useful. |
| RaMP | Rapid Modernization Plan | Microsoft's prioritized roadmap for securing privileged access quickly. | Rapid Modernization Plan (RaMP) sequences this whole part: stop new risk first (Just-In-Time (JIT), Privileged Access Workstations (PAWs)), then clean up existing exposure. |
| RBAC | Role-Based Access Control | Granting access by role rather than to individuals. | Just-In-Time (JIT) builds on Role-Based Access Control (RBAC): you make people eligible for a role, not permanently assigned to it. |
| RC4 | Rivest Cipher 4 | A legacy stream cipher, a weak Kerberos encryption type. | Protected Users forbids Rivest Cipher 4 (RC4); RC4 service tickets for a privileged account are a Kerberoasting signal. |
| RDP | Remote Desktop Protocol | Windows interactive remote-session protocol. | An admin who Remote Desktop Protocols (RDPs) with a privileged account caches a reusable credential on the destination host. |
| RID | Relative Identifier | The trailing part of a Security Identifier (SID) that is unique within a domain. | The built-in Administrator (Relative Identifier (RID) 500) is a known gap: some Protected Users protections don't fully apply to it. |
| RPC | Remote Procedure Call | A protocol for invoking functions on a remote system. | Coercion techniques abuse specific Remote Procedure Call (RPC) interfaces to force a machine to authenticate. |
| SAW | Secure Admin Workstation | Another name for a hardened administrative workstation (a Privileged Access Workstation (PAW)). | Some organizations and vendors call the Privileged Access Workstation (PAW) a Secure Admin Workstation (SAW); the concept is identical. |
| SID | Security Identifier | The unique value that identifies a security principal in Windows. | Silo and deny-logon rules resolve to Security Identifiers (SIDs); the krbtgt-signed PAC carries them in the ticket. |
| SIEM | Security Information and Event Management | A platform that centralizes and correlates security logs. | Silo denials, NTLM-on-Protected-User events and Privileged Identity Management (PIM) activations are correlated and alerted in the Security Information and Event Management (SIEM). |
| SOC | Security Operations Center | The team that monitors and responds to security alerts. | The Security Operations Center (SOC) treats a tier-boundary violation or an unexpected Privileged Identity Management (PIM) activation as a potential takeover. |
| SSO | Single Sign-On | Signing in once to gain access to many systems. | Single Sign-On (SSO) is why credentials stay resident in memory; the privileged-access controls bound where and how long. |
| TGT | Ticket-Granting Ticket | The Kerberos ticket that proves identity and is used to request service tickets. | Protected Users caps the Ticket-Granting Ticket (TGT) to four hours; an authentication policy can set a different lifetime. |
| TPM | Trusted Platform Module | A hardware chip that stores keys and measures boot integrity. | A Privileged Access Workstation (PAW) should have a Trusted Platform Module (TPM) so its disk encryption and health attestation are hardware-rooted. |
| TTL | Time To Live | How long something remains valid before it expires. | On-prem Just-In-Time (JIT) is often done with TTL-based (time-boxed) group membership. |
| UEFI | Unified Extensible Firmware Interface | Modern firmware that replaces the legacy BIOS, with Secure Boot. | Secure Boot (UEFI) and a Trusted Platform Module (TPM) are prerequisites for Credential Guard and a trustworthy Privileged Access Workstation (PAW). |
| UPN | User Principal Name | A logon name in email form, like adm0-jordan@corp.local. | Per-tier admin accounts are distinguished by User Principal Name (UPN) convention and placed in the matching silo. |
| VBS | Virtualization-Based Security | Windows security that uses the hypervisor to isolate sensitive processes. | Credential Guard relies on Virtualization-Based Security (VBS) to hold secrets in an enclave the normal Operating System (OS), and malware, can't reach. |
| VDI | Virtual Desktop Infrastructure | Centrally-hosted virtual desktops delivered to users. | A Virtual Desktop Infrastructure (VDI) or Cloud PC privileged session can serve as an interim clean source before physical Privileged Access Workstations (PAWs). |
| VM | Virtual Machine | A software-emulated computer running on a hypervisor. | A split Privileged Access Workstation (PAW) design can run the privileged environment and a user Virtual Machine (VM) on one device, strongly isolated. |
| WDAC | Windows Defender Application Control | A Windows feature that allows only approved code to run. | A Privileged Access Workstation (PAW) uses Windows Defender Application Control (WDAC) (or AppLocker) allow-listing so only vetted admin tools can execute. |
Test yourself
Flashcards
Quiz
Fifteen questions, weighted toward the judgment calls of a rollout, and of assessing someone else's, telling a configured control from an enforcing one, spotting the fatal exclusion, and sequencing safely.
Conversation drills
Say or type your answer first, then compare with the sample.
Export cards
Basic cards (Quizlet and Anki Basic)
Anki cloze cards
My private notebook
Personal notes and bookmarks are private. Unsaved text is temporarily kept in this tab’s browser storage to recover supported sign-in redirects and reloads. Closing the tab may lose unsaved text.
Checking sign-in…