Tier 0: Protecting AD's Most Critical Assets

Tier 0 designates the most critical assets in an Active Directory environment. These are the assets whose compromise grants full control over the entire identity infrastructure. Tier 0 includes Domain Controllers, the AD DS database (ntds.dit), ADFS servers, PKI root Certificate Authorities, and any account holding Domain Admin, Enterprise Admin, or Schema Admin privileges. The concept originates from Microsoft's Enterprise Access Model, which partitions privileged resources into three tiers to limit lateral movement. A Tier 0 compromise means an attacker can forge Kerberos tickets (Golden Ticket), replicate directory data via DCSync, or push arbitrary GPOs to every machine in the domain. This makes Tier 0 the primary target in advanced intrusions, including APT campaigns and ransomware operations that deliberately pursue domain dominance before deploying payloads. Protecting these assets is not optional: any account, workstation, or service that can authenticate to or administer a Domain Controller must itself be treated as Tier 0, regardless of its apparent function.

Detecting attacks against Tier 0 assets requires dedicated monitoring on Domain Controllers and privileged management hosts. Event ID 4662 logs access to sensitive AD objects, including directory replication requests that indicate a DCSync attempt. Event ID 4742 tracks computer account modifications, while 4768 and 4769 cover Kerberos TGT and service ticket requests. Unusual replication traffic from non-DC hosts, detected via Windows Event ID 4929 or network-level monitoring of DRSUAPI RPC calls, is a strong indicator of DCSync. Logon events (4624, 4648) originating from unexpected workstations targeting Domain Controllers should trigger immediate investigation. Tools such as Microsoft Defender for Identity (MDI), formerly Azure ATP, generate alerts specifically for DCSync, Pass-the-Hash, and Golden Ticket usage. Honey accounts with no legitimate use, placed in high-privilege groups, provide low-noise detection when any authentication is attempted. SIEM correlation rules should baseline normal replication partners and flag any deviation. Audit policies on Domain Controllers must enable 'DS Access' and 'Account Logon' subcategories at the Success and Failure level.

Red Team operators target Tier 0 through several well-documented attack paths. DCSync, implemented in Mimikatz via the 'lsadump::dcsync' module, abuses the DS-Replication-Get-Changes-All right to extract password hashes without touching the ntds.dit file directly. Golden Ticket attacks forge TGTs using the KRBTGT hash, granting persistent domain access even after password resets on regular accounts. AdminSDHolder abuse allows an attacker with temporary Domain Admin access to backdoor ACLs so that privileged group memberships become persistent. Credential Guard and Protected Users security group membership reduce credential exposure on endpoints. Hardening Tier 0 requires Privileged Access Workstations (PAWs) dedicated exclusively to administering Tier 0 systems, with no internet access and enforced application whitelisting. Kerberos delegation on Tier 0 accounts must be disabled: set the 'Account is sensitive and cannot be delegated' flag and remove any delegation configuration. KRBTGT password should be rotated twice consecutively to invalidate existing Golden Tickets. Finally, tiering enforcement via GPO should block Tier 0 credentials from ever being used to authenticate to lower-tier hosts, preventing credential theft through compromised workstations.