Tiered Administrative Model: Enforcing Strict Logon Boundaries & Windows LAPS

The "Why" Before the "How": Stopping Pass-the-Hash at the Root

In a flat administrative architecture, an engineer logs into an end-user laptop using their domain administrator credentials to troubleshoot an application. The moment that login occurs, their high-privilege NTLM hash or Kerberos Ticket Granting Ticket (TGT) is cached in the Local Security Authority Subsystem Service (LSASS) memory of that endpoint.

If that workstation is compromised, an attacker running Mimikatz or invoking dumpert dumps LSASS memory, extracts the domain administrator's credential material, and executes a Pass-the-Hash attack to compromise every server and domain controller in the enterprise.

To eliminate credential exposure, enterprise engineering enforces two foundational controls:

1. The Tiered Administrative Model: Enforcing rigid Group Policy logon boundaries where credentials can never touch a lower-tier machine.
2. Windows LAPS (Local Administrator Password Solution): Dynamically generating unique, randomized passwords for the local Administrator account on every endpoint and storing them securely in Active Directory or Entra ID.

---

1. The 3-Tier Enterprise Administrative Architecture

We divide all assets, identities, and administrative accounts into three non-negotiable tiers:

flowchart TD
    subgraph Tier0 [Tier 0: Control Plane & Identity]
        T0_Assets["Domain Controllers (DC01)<br>PKI / CA Servers<br>Entra Connect Sync"]
        T0_Admins["T0 Admins (adm-dario-t0)<br>• Only logs onto Tier 0<br>• Strictly blocked from T1 & T2"]
    end

    subgraph Tier1 [Tier 1: Enterprise Servers & Infrastructure]
        T1_Assets["ConfigMgr Primary Site (CM01)<br>SQL Server Databases<br>Proxmox Management Hosts"]
        T1_Admins["T1 Admins (adm-dario-t1)<br>• Only logs onto Tier 1<br>• Blocked from T0 & T2"]
    end

    subgraph Tier2 [Tier 2: User Endpoints & Workstations]
        T2_Assets["Windows 11 Laptops (Latitude 5420)<br>Virtual Reference Desktops (CLIENT01)<br>Printers & Edge Peripherals"]
        T2_Admins["T2 Desktop Techs (adm-dario-t2)<br>• Only logs onto Endpoints<br>• Zero server access"]
    end

    T0_Admins -.->|"CANNOT LOG ON"| T1_Assets
    T0_Admins -.->|"CANNOT LOG ON"| T2_Assets
    T1_Admins -.->|"CANNOT LOG ON"| T0_Assets
    T1_Admins -.->|"CANNOT LOG ON"| T2_Assets
    T2_Admins -.->|"CANNOT LOG ON"| T0_Assets
    T2_Admins -.->|"CANNOT LOG ON"| T1_Assets

The Cardinal Rule of Tiered Administration

[!IMPORTANT] Credentials must never cross tier boundaries downwards. A Tier 0 credential must never be typed, cached, or negotiated on a Tier 1 server or Tier 2 workstation. If an admin needs to configure an endpoint, they must log in using a dedicated adm-*-t2 account or use Windows LAPS.

---

2. Enforcing Logon Boundaries via Group Policy

We configure dedicated Group Policy Objects (GPOs) linked to each tier's Organizational Unit. Using Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment, we enforce explicit denial rules:

GPO Policy Matrix

Target OU	Policy Setting	Enforced Value
Tier 1 Servers	Deny log on locally	CORP\Tier0-Admins, CORP\Tier2-Admins
Tier 1 Servers	Deny log on through Remote Desktop Services	CORP\Tier0-Admins, CORP\Tier2-Admins
Tier 2 Workstations	Deny log on locally	CORP\Tier0-Admins, CORP\Tier1-Admins, CORP\Domain Admins
Tier 2 Workstations	Deny log on through Remote Desktop Services	CORP\Tier0-Admins, CORP\Tier1-Admins, CORP\Domain Admins

(By explicitly denying Domain Admins and Tier0-Admins from logging into workstations, LSASS memory on client PCs is physically incapable of caching Tier 0 credentials).

---

3. Windows LAPS: Modern Schema & Password Rotation

With legacy tools, helpdesk technicians often set the exact same static local administrator password on every desktop image. Compromising one laptop yielded local admin rights across the entire fleet.

Modern Windows LAPS (built natively into modern Windows 11 and Server 2022) replaces static passwords with automated, cryptographic rotation:

Core Configuration Parameters in GPO

Under Computer Configuration > Administrative Templates > System > LAPS:

• Backup Directory: Active Directory (or Microsoft Entra ID)
• Password Settings:
  • Password complexity: Large letters + small letters + numbers + special characters
  • Password length: 16 characters
  • Password age: 30 days
• Administrator Account Name: Custom name (e.g., lapsadmin) or managed built-in SID.
• Post-Authentication Actions:
  • Action: Reset password and log off managed account
  • Grace period: 2 hours (The moment a desktop tech logs off, LAPS immediately destroys the password, forces a rotation, and writes the new secret to Active Directory).

---

4. Verification: Trust, but Verify

1. Retrieve the LAPS Password via PowerShell

From an authorized Tier 2 technician workstation:

Get-LapsDiagnostics -ComputerName "CLIENT01"

2. Verify Credential Boundary Blocking

Attempt to connect to a Tier 2 workstation (CLIENT01) using a Tier 0 administrator account over PowerShell remoting or RDP:

Enter-PSSession -ComputerName "CLIENT01" -Credential (Get-Credential "CORP\adm-dario-t0")

Expected Healthy Failure:

Enter-PSSession : Connecting to remote server CLIENT01 failed with the following error message : 
Access is denied. (Logon failure: the user has not been granted the requested logon type at this machine).

(The connection is actively blocked by the User Rights Assignment GPO, proving that the administrative credential boundary held).