Cyberlium

Active › Module 7 › Lesson 1

BeginnerModule 7Lesson 1/5

Tiering PAW

Admin tiering and Privileged Access Workstations (PAW) literacy — reduce blast radius on $LAB_AD and production design discussions.

15 min+40 XP3 quiz
Module progress1 of 5

Visual · t25_tiering_paw

Tiering + PAW = separate admin tiers and hardened workstations. Original Cyberlium.

Opening

Domain Admin from a helpdesk laptop is a design failure — tiering and PAW fix the architecture, not the attacker.

Tiering model literacy: Tier 0 (forest/domain controllers, identity systems), Tier 1 (servers), Tier 2 (workstations/end-user). Privileged Access Workstations (PAW) are dedicated hardened hosts for Tier 0/1 admin tasks — no email, no browsing, strict jump access. Analyst maps why DCSync and ACL paths hurt more when Tier 0 creds touch Tier 2 daily drivers. Defenders: separate admin accounts, deny interactive logon for Tier 0 on lower tiers, deploy PAW or equivalent controls, monitor tier violations (4624 logon type anomalies). Cyberlium teaches tier/PAW design on YOUR $LAB_AD diagrams and architecture notes — NOT bypassing tier controls on stranger domains, NOT using employer workstation as DA login homework. Document one tier violation scenario on lab and the PAW fix.

1. Three tiers

Tier 0: identity/DC — highest protection. Tier 1: servers. Tier 2: users/workstations.

Credential flow should descend tiers only through controlled jump/PAW — not daily driver DA.

Command guide

Try these commands — Three tiers

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Microsoft PAW — https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-workstations (PAW literacy) Microsoft tiering model — https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model (Tier 0/1/2) CISA AD best practices — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
python3 - <<'PY'
tiers = {0: 'Domain controllers / identity', 1: 'Servers', 2: 'Workstations'}
for t, desc in tiers.items(): print(f'Tier {t}: {desc}')
print('PAW: dedicated hardened workstation for Tier 0 admins')
PY

Command — copy this

curl -sS https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-workstations | head -8
curl -sS https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model | head -6

Primary tools to practice this lesson: curl, python3. Reference sites: Microsoft PAW (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-workstations); Microsoft tiering model (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model); CISA AD best practices (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. PAW purpose

Dedicated admin workstation hardened — reduces malware and token theft on privileged sessions.

Pair with Credential Guard and LSA protection in next lessons.

3. Lab mapping

Sketch $LAB_AD with tier labels on VMs — which host should never hold Tier 0 session.

Finding: helpdesk user in Domain Admins on workstation tier — remediate with tiering split.

4. What you ship: tiering PAW diagram

Tier 0/1/2 definitions + PAW one-liner + lab topology sketch + one violation fix.

5. What you record before the next lesson

Tiering PAW diagram path.

6. Wrong vs right: stranger-domain attacks vs lab AD literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

  • Wrong

    Log in Domain Admin on daily driver 'because lab is faster.'

  • Right

    Tiering PAW diagram for $LAB_AD. Next: gMSA SPN Hygiene.

Mission: tiering PAW diagram

1) Define three tiers. 2) Define PAW in one line. 3) Sketch $LAB_AD tier labels. 4) One violation + fix row.

Stuck? Ask Cyberlium AI Mentor

Ask Mentor: “Tier 0 interactive logon deny — GPO literacy?”

Knowledge Check

1

APPLY: Tier 0 includes:

Multiple choice

Knowledge Check

2

APPLY: True or False: DA login on Tier 2 workstation is best practice.

True or False

Knowledge Check

3

APPLY: PAW purpose:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)