Active › Module 7 › Lesson 1
Tiering PAW
Admin tiering and Privileged Access Workstations (PAW) literacy — reduce blast radius on $LAB_AD and production design discussions.
Visual · t25_tiering_paw
Tiering + PAW = separate admin tiers and hardened workstations. Original Cyberlium.
Opening
Domain Admin from a helpdesk laptop is a design failure — tiering and PAW fix the architecture, not the attacker.
Tiering model literacy: Tier 0 (forest/domain controllers, identity systems), Tier 1 (servers), Tier 2 (workstations/end-user). Privileged Access Workstations (PAW) are dedicated hardened hosts for Tier 0/1 admin tasks — no email, no browsing, strict jump access. Analyst maps why DCSync and ACL paths hurt more when Tier 0 creds touch Tier 2 daily drivers. Defenders: separate admin accounts, deny interactive logon for Tier 0 on lower tiers, deploy PAW or equivalent controls, monitor tier violations (4624 logon type anomalies). Cyberlium teaches tier/PAW design on YOUR $LAB_AD diagrams and architecture notes — NOT bypassing tier controls on stranger domains, NOT using employer workstation as DA login homework. Document one tier violation scenario on lab and the PAW fix.
1. Three tiers
Tier 0: identity/DC — highest protection. Tier 1: servers. Tier 2: users/workstations.
Credential flow should descend tiers only through controlled jump/PAW — not daily driver DA.
Command guide
Try these commands — Three tiers
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Microsoft PAW — https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-workstations (PAW literacy) Microsoft tiering model — https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model (Tier 0/1/2) CISA AD best practices — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
python3 - <<'PY'
tiers = {0: 'Domain controllers / identity', 1: 'Servers', 2: 'Workstations'}
for t, desc in tiers.items(): print(f'Tier {t}: {desc}')
print('PAW: dedicated hardened workstation for Tier 0 admins')
PYCommand — copy this
curl -sS https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-workstations | head -8 curl -sS https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model | head -6
Primary tools to practice this lesson: curl, python3. Reference sites: Microsoft PAW (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-workstations); Microsoft tiering model (https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model); CISA AD best practices (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. PAW purpose
Dedicated admin workstation hardened — reduces malware and token theft on privileged sessions.
Pair with Credential Guard and LSA protection in next lessons.
3. Lab mapping
Sketch $LAB_AD with tier labels on VMs — which host should never hold Tier 0 session.
Finding: helpdesk user in Domain Admins on workstation tier — remediate with tiering split.
4. What you ship: tiering PAW diagram
Tier 0/1/2 definitions + PAW one-liner + lab topology sketch + one violation fix.
5. What you record before the next lesson
Tiering PAW diagram path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Log in Domain Admin on daily driver 'because lab is faster.'
Right
Tiering PAW diagram for $LAB_AD. Next: gMSA SPN Hygiene.
Mission: tiering PAW diagram
1) Define three tiers. 2) Define PAW in one line. 3) Sketch $LAB_AD tier labels. 4) One violation + fix row.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Tier 0 interactive logon deny — GPO literacy?”
Knowledge Check
APPLY: Tier 0 includes:
Multiple choice
Knowledge Check
APPLY: True or False: DA login on Tier 2 workstation is best practice.
True or False
Knowledge Check
APPLY: PAW purpose:
Multiple choice