Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, privileged access workstations (PAWs), administrative forest design, and authentication policy silos. Use when designing or hardening AD privileged-access architecture, segmenting Domain/Enterprise Admin accounts into tiers, or containing lateral movement and credential theft (pass-the-hash, Kerberoasting, golden tickets).
Start a fresh conversation. Replace the highlighted placeholders.
Use configuring-active-directory-tiered-model to design an ESAE Tier 0/1/2 privileged-access architecture for [Active Directory environment and administrative roles], including PAW, administrative-forest, authentication-policy-silo, monitoring, and compliance documentation recommendations; validate the proposal in [authorized test or lab environment] and stop for my final confirmation before applying any shared identity, access, or security-policy changes.
Required inputs
[Active Directory environment and administrative roles]
[authorized test or lab environment]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: configuring-active-directory-tiered-modeldescription: Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, privileged access workstations (PAWs), administrative forest design, and authentication policy silos. Use when designing or hardening AD privileged-access architecture, segmenting Domain/Enterprise Admin accounts into tiers, or containing lateral movement and credential theft (pass-the-hash, Kerberoasting, golden tickets).domain: cybersecuritysubdomain: identity-access-managementtags: - iam- identity- access-control- active-directory- tiered-model- paw- esaeversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.AA-01- PR.AA-02- PR.AA-05- PR.AA-06mitre_attack: - T1078.002- T1550.002- T1550.003- T1003.001- T1021
Configuring Active Directory Tiered Model
Overview
Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. Covers Tier 0/1/2 separation, privileged access workstations (PAWs), administrative forest design, authentication policy silos, and credential theft mitigation.
When to Use
When deploying or configuring configuring active directory tiered model capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Familiarity with identity access management concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Objectives
Implement comprehensive configuring active directory tiered model capability
Establish automated discovery and monitoring processes
Integrate with enterprise IAM and security tools
Generate compliance-ready documentation and reports
Align with NIST 800-53 access control requirements
Security Controls
Control
NIST 800-53
Description
Account Management
AC-2
Lifecycle management
Access Enforcement
AC-3
Policy-based access control
Least Privilege
AC-6
Minimum necessary permissions
Audit Logging
AU-3
Authentication and access events
Identification
IA-2
User and service identification
Verification
Implementation tested in non-production environment
Security policies configured and enforced
Audit logging enabled and forwarding to SIEM
Documentation and runbooks complete
Compliance evidence generated
configuring-active-directory-tiered-model by mukul975 · The Skill Leaderboard