Watching a video series about Active Directory and doing security based on tiers. You have the main administrators in Tier-0 and End users in Tier-2 for example sakes.

The idea is administrator level users never have access to anything but tier-0 to avoid token compromises ect.. You also avoid generic accounts for audit purposes.

My question is this. You are an administrator and you work heavily in Tier-0, but you also work in Tier-2 where you access the internet, emails and remote into other Tier-2 machines for remote desktop work. Do you generally create another account for Tier-0 work or assign yourself privileges do that level on a need to use basis?

2 Answers 2


Microsoft is suggesting that you do both.

This is a part of their PowerShell v5 paradigm known as JIT/JEA (or JitJea) aka Just In Time, Just Enough Administration.


Where I've seen this done, separate accounts were used.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .