1

In Microsoft’s Securing Privileged Access Reference material it states:

Tier 0 administrator - manage the identity store and a small number of systems that are in effective control of it, and:

  • Can manage and control assets at any level as required
  • Can only log on interactively or access assets trusted at the Tier 0 level

Tier 1 administrator - manage enterprise servers, services, and applications, and:

  • Can only manage and control assets at the Tier 1 or Tier 2 level
  • Can only access assets (via network logon type) that are trusted at the Tier 1 or Tier 0 levels
  • Can only interactively log on to assets trusted at the Tier 1 level

Tier 2 administrator - manage enterprise desktops, laptops, printers, and other user devices, and:

  • Can only manage and control assets at the Tier 2 level
  • Can access assets (via network logon type) at any level as required
  • Can only interactively log on to assets trusted at Tier 2 level

Why can Tier 2 (Desktop admins) - access assets at any level as required, but Tier 1 (Server Admins) can only access assets that are trusted at the Tier 1 or Tier 0 levels & Tier 0 is not permitted to access any assets?

Seems very strange to me. Is anyone able to explain the logic behind this?

0

Its about the security level of the Tier 1 and 2 assets. They are considered to be less safe than then Tier 0 assets and therefore a Tier 0 admin account should never long on to those assets as it would create an attack vector against that account.

And it might be superfluous to add but typically a person that required access to tier 0,1,2 would do so using different accounts for each - so Bob_admin_0, Bob_admin_1 and Bob_admin_2 ( and a normal user Bob).

0

The statement that Tier-2 level administrators can access assets at higher tiers via network logon does not mean they can have administrative access to those higher tier assets.

Take Domain Controllers for example: the Tier-2 admin can access the SYSVOL/NETLOGON network shares, but would not have any administrative access to the DC operating system.

The primary focus of this reference material is controlling credential exposure. You never want higher tier credentials exposed at a lower tier. Exposing a lower tier to a higher tier is allowed.

1
  • I probably should have included a picture ;) – twconnell Apr 30 '20 at 21:20
0

You need to distinguish between "access" and "control". Everyone needs to "access" a domain controller or a file server. That's what they are for.

Access and control restrictions

Primary responsibilities and critical restrictions

Tier 0 administrator - manage the identity store and a small number of systems that are in effective control of it, and:

  • Can manage and control assets at any level as required
  • Can only log on interactively or access assets trusted at the Tier 0 level

Tier 1 administrator - manage enterprise servers, services, and applications, and:

  • Can only manage and control assets at the Tier 1 or Tier 2 level
  • Can only access assets (via network logon type) that are trusted at the Tier 1 or Tier 0 levels
  • Can only interactively log on to assets trusted at the Tier 1 level

Tier 2 administrator - manage enterprise desktops, laptops, printers, and other user devices, and:

  • Can only manage and control assets at the Tier 2 level
  • Can access assets (via network logon type) at any level as required
  • Can only interactively log on to assets trusted at Tier 2 level

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.