Which account belongs in which Tier? A practical guide to Tier 0, Tier 1 and Tier 2?

Active Directory tiering is one of the most important concepts for protecting a Windows domain against credential theft and lateral movement.

The basic idea is simple:

Not every administrator should be able to access every system.

If an attacker compromises a workstation and finds a privileged administrator credential there, that credential should not give them a path directly to the Domain Controllers.

This is what the classic Active Directory Tier Model is designed to prevent.

It divides accounts, systems and administrative access into three security levels:

• Tier 0 – Identity and Active Directory
• Tier 1 – Servers and applications
• Tier 2 – Workstations and end-user devices

The most important question is therefore:Which account belongs in which Tier?

What Is Active Directory Tiering?

Active Directory tiering creates separate trust boundaries for administrative access.

An administrator who manages workstations should not use the same privileged account to administer servers.

Likewise, a server administrator should not use their account to administer Domain Controllers.

The reason is straightforward.

Imagine an attacker compromises a workstation using phishing or malware. If a Domain Admin has logged onto that workstation, the attacker may be able to steal credentials or authentication material.

The attacker can then use those credentials to move to a server, and potentially eventually to a Domain Controller.

This is exactly the type of privilege escalation and lateral movement that tiering is designed to prevent. Microsoft describes the model as separating administrative identities, workstations and managed assets into different trust tiers.

The Three Active Directory Tiers

Before looking at individual accounts, we need to understand the three tiers.

The important part is control.

An account belongs to a tier based on what it can control — not simply where the account is stored.

Tier 0 – The Identity Control Plane

Tier 0 is the most privileged and sensitive tier.

It contains everything that can directly or indirectly control Active Directory or enterprise identities.

Typical Tier 0 systems include:

• Domain Controllers
• Active Directory Domain Services
• Active Directory Certificate Services (AD CS)
• Active Directory Federation Services (AD FS)
• Microsoft Entra Connect
• Systems that directly administer Domain Controllers
• Tier 0 administrative workstations

Microsoft also includes systems such as backup, monitoring, patching, hypervisor and security solutions in Tier 0 when they have the ability to control or directly influence Tier 0 systems.

Typical Tier 0 accounts

Important:

Tier 0 does not mean “Domain Admin only.”

An account does not need to be a member of Domain Admins to be Tier 0.

If the account can compromise or control the identity infrastructure, it should be treated as Tier 0.

Tier 1 – Servers and Applications

Tier 1 contains enterprise servers and the applications running on them.

Examples include:

• Windows member servers
• SQL Server
• Exchange Server
• SharePoint
• Application servers
• File servers
• Web servers
• Business applications

A Tier 1 administrator can manage these systems but must not be able to administer Tier 0 systems.

Microsoft defines Tier 1 as the enterprise server and application management tier.

Typical Tier 1 accounts

The asterisk is important.

A backup or monitoring account is not automatically Tier 1.

If that account can also administer or restore Domain Controllers, it may effectively become Tier 0.

Tier 2 – Workstations and End Users

Tier 2 is the lowest administrative tier in the classic model.

It covers:

• User workstations
• Laptops
• End-user devices
• Helpdesk administration
• Workstation administration
• Standard user accounts

Typical Tier 2 accounts include:

Microsoft specifically places helpdesk, device support and end-user account administration in Tier 2.

The Most Important Rule: Separate Administrator Accounts

One of the biggest mistakes in Active Directory is using one account for everything.

For example:

User
    ↓
Domain Admin
    ↓
Daily email
    ↓
Web browser
    ↓
Teams
    ↓
Workstation administration
    ↓
Domain Controller administration

This is a bad security model.

If the workstation is compromised, the Domain Admin credentials may also be exposed.

A better approach is:

User
   │
   ├── Normal account
   │      └── Email / Teams / Web / Daily work
   │
   ├── Tier 2 admin
   │      └── Workstations
   │
   ├── Tier 1 admin
   │      └── Servers
   │
   └── Tier 0 admin
          └── Active Directory / Domain Controllers

Each administrative identity should be restricted to its appropriate tier.

Microsoft explicitly recommends keeping credentials within a single tier because reusing credentials across tiers destroys the trust boundary.

What About Service Accounts?

This is where Active Directory tiering often becomes confusing.

A common misconception is:

“It’s a service account, so it must be Tier 0.”

That is not correct.

The tier depends on what the account can control.

Example 1 – SQL service account

Suppose:

svc-sql
    ↓
SQL Server
    ↓
Tier 1

If svc-sql only has the permissions required by SQL Server and cannot control Tier 0 systems, it belongs in Tier 1.

Example 2 – Service account on a Domain Controller

Now imagine:

svc-backup
    ↓
Domain Controller
    ↓
Backup / restore / system access

This account should be considered Tier 0 because it operates within or can influence a Tier 0 system.

Example 3 – One account everywhere

This is dangerous:

svc-management
    ↓
Domain Controllers
Servers
Workstations

Now a compromise of a workstation or server could expose credentials that can also be used against Tier 0.

Do not reuse service accounts across tiers.

What About Backup Accounts?

Backup systems deserve special attention.

Imagine a backup administrator has:

Backup Server
      ↓
Can restore Domain Controller
      ↓
Can manipulate system state
      ↓
Can influence Active Directory

That backup infrastructure becomes part of the Tier 0 trust boundary.

This is why simply saying:

“Backup server = Tier 1”

can be incorrect.

The correct question is:

Can this account or system control or recover a Tier 0 system?

If yes, treat it accordingly.

Microsoft specifically identifies backup and other management solutions as potentially Tier 0 when they can directly control Tier 0 systems.

What About EDR, Monitoring and Management Tools?

The same principle applies to:

• EDR
• Antivirus
• RMM
• Monitoring
• Patch management
• Configuration management
• Backup
• Hypervisor management

For example:

EDR Agent
    ↓
Local SYSTEM
    ↓
Domain Controller

That EDR infrastructure has a very high level of trust.

If the management platform can execute commands with SYSTEM-level privileges on Domain Controllers, compromising the management platform could potentially lead to domain compromise.

Therefore, the question should never simply be:

“Is this an EDR account?”

Instead ask:
“What can this account or management system control?”

That is the more useful security question.

What About Computer Accounts?

Computer accounts also need to be considered.

A normal workstation:

PC-001$

belongs to the Tier 2 environment.

A member server:

SERVER-001$

belongs to Tier 1.

A Domain Controller:

DC01$

belongs to Tier 0.

Again, the principle is based on the system’s role and its ability to influence the environment.

Domain Admin Is Not “The Administrator Account”

Another common mistake is giving a normal administrator account Domain Admin membership because:

“I’m the IT administrator.”

Your job title does not determine the tier.

Your permissions and administrative scope determine the tier.

An IT administrator may legitimately have:

Normal Account       → Tier 2
Workstation Admin    → Tier 2
Server Admin         → Tier 1
AD Admin             → Tier 0

The same person can therefore have multiple administrative identities.

That is not unnecessary complexity.

It is a security control.

Where Should Helpdesk Accounts Go?

Helpdesk accounts normally belong in Tier 2.

For example, a helpdesk administrator might be allowed to:

• Reset passwords
• Unlock users
• Join computers to the domain
• Administer workstations
• Install software
• Troubleshoot endpoints

These activities are normally Tier 2.

However, if the helpdesk account is given permissions that allow it to administer Domain Controllers or other Tier 0 resources, it effectively crosses the trust boundary.

That permission should be questioned.

The Tiering Cheat Sheet

If you need a quick reference, use this:

* The exact tier depends on the permissions and systems the service account can control.

The Biggest Active Directory Tiering Mistakes

1. Using Domain Admin for daily work

This is probably the most common mistake.

Don’t browse the internet, read email or use Teams while logged in with a Domain Admin account.

2. Using the same administrator account everywhere

For example:

Administrator
   ↓
Workstations
Servers
Domain Controllers

This completely undermines tiering.

3. Giving service accounts excessive privileges

A service account should have the minimum permissions required for its function.

4. Forgetting management systems

Backup, monitoring, RMM, EDR and virtualization platforms can become extremely powerful attack paths.

5. Treating a jump server as a security boundary

A jump server does not magically create a new tier.

If it is used to administer Domain Controllers, it is part of the Tier 0 trust boundary.

6. Putting everything into Tier 0

This is also a mistake.

If every server, application and administrator is considered Tier 0, the tier loses its purpose.

Microsoft explicitly recommends keeping Tier 0 as small as possible.

What About Privileged Access Workstations?

Tiering is not only about accounts.

The workstation used to access the account matters too.

A Tier 0 administrator should not simply log into their normal Windows workstation and start managing a Domain Controller.

The classic model therefore uses Privileged Access Workstations (PAWs) corresponding to the administrative tier.

For example:

Tier 0 Admin
     ↓
Tier 0 PAW
     ↓
Domain Controller

rather than:

Tier 0 Admin
     ↓
Normal Office PC
     ↓
Domain Controller

The second model exposes the Tier 0 credentials to a lower-trust device.

Microsoft describes the PAW as an important enforcement mechanism for the tier boundaries.

Final Rule: Think in Terms of Control

When deciding where an account belongs, don’t start with the account name.

Don’t ask:
“Is this a service account?”

Don’t ask:
“Is this an IT administrator?”

Ask:
“What can this account control?”

If it can control identity and Active Directory, think Tier 0.

If it can control servers and enterprise applications, think Tier 1.

If it can control workstations and normal user accounts, think Tier 2.

The goal is to prevent a compromise at a lower tier from becoming a shortcut into a higher tier.

             TIER 0
       Identity / AD / DCs
              ▲
              │
        Trust boundary
              │
             TIER 1
       Servers / Applications
              ▲
              │
        Trust boundary
              │
             TIER 2
       Users / Workstations

The lower the tier, the less it should be able to influence the tiers above it.

That is the core idea behind Active Directory Tiering.