Creating a Tier-0, which is basically a "God Group" in Red Forest AD model seems a bit off to me, so I was wondering about its logic.


Tier 0 is where the crown jewels are kept. Specifically, forest and domain administration privileges. If you isolate those activities and accounts that have that level of access to Tier 0, you can isolate use of DA privileged accounts to that forest. Thus, an attacker who compromises a Tier 1 (server) or Tier 2 (workstation) can never harvest DA creds from one of those machines and elevate to that level.

It's a way to limit an attacker's ability to move laterally within the network to some degree, but more importantly to limit their ability to elevate to an account that would allow them to own the entire network.

A more comprehensive overview can be found here: Active Directory administrative tier model if you would like more in-depth information.

  • So once they got to TIER-0, game over? – Filipon May 10 '19 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.