What is Tier Zero?

Why "zero"?

Microsoft's administrative tier model splits an organization's IT into layers by how much they control. Tier 2 is workstations and the people who support them. Tier 1 is servers and applications. Tier 0, or Tier Zero, is the identity system itself: Active Directory, and everything that can change it.

The core rule: a lower tier must never be able to control a higher one. A helpdesk account (Tier 2) shouldn't be able to reset a Domain Admin's password (Tier Zero), and a Domain Admin shouldn't sign in to ordinary workstations, where an attacker on a Tier 2 computer could steal their credentials. Microsoft's current guidance calls this the enterprise access model, and SpecterOps' BloodHound, which Pathwarden follows, uses the name Tier Zero for this control plane.

What belongs in Tier Zero

Pathwarden builds Tier Zero for you from the collected data. It starts from:

• The domain itself, its domain controllers, the Domain Controllers OU and AdminSDHolder (the template for privileged accounts' permissions).
• The built-in privileged groups and accounts: Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Server Operators, Print Operators, Backup Operators, Key Admins, krbtgt and the built-in Administrator.
• Certificate Services trust anchors: the Enterprise CAs, root and AIA CAs, the NTAuth store, the servers that host an Enterprise CA, and Cert Publishers. A CA can issue a certificate that signs in as anyone.
• Group Policy Objects linked to anything in Tier Zero, because a GPO runs code on what it's linked to.
• Management planes^* the directory reveals: the Entra Connect sync account and the server that holds its password, the Seamless SSO account, and SCOM servers that manage domain controllers. See PW-025.
• Entra ID's own Tier Zero^*, when you add AzureHound data: the tenant; the Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator and Directory Synchronization Accounts roles; their holders, active or eligible, directly or through a role-assignable group; service principals granted the Microsoft Graph application permission RoleManagement.ReadWrite.Directory or AppRoleAssignment.ReadWrite.All; and the application of each Tier Zero service principal.
• Anything you add with tier_zero = [...] in pathwarden.toml: typically PAM or password-vault servers, backup servers that back up domain controllers, and the hypervisors that host them.

Members of Tier Zero groups are Tier Zero too, with one deliberate exception: the forest-wide groups (Domain Users, Domain Computers, Authenticated Users, Everyone). If one of those is nested into an admin group, Pathwarden doesn't conclude that every account is Tier Zero. It reports the nesting as a finding, PW-001, because it is nearly always a mistake.

Why "whoever controls one controls all"

Tier Zero objects can all reach each other. A Domain Admin can sign in to a domain controller. A domain controller holds every password hash, including krbtgt's, which forges a ticket for any account. A CA server can issue a certificate for any Domain Admin. A GPO linked to the Domain Controllers OU runs code on every domain controller.

That's why Pathwarden treats any path into any Tier Zero object as a path to the domain, and why one weak link, such as an old service account with a Domain Admin's password reset right, matters so much.

Tier Zero that nobody decided on

The most dangerous Tier Zero is the kind nobody labeled. A backup server that stores copies of domain controllers. The Entra Connect server. An SCCM site that deploys software to domain controllers. A hypervisor cluster running virtual DCs. These systems are part of Tier Zero whether or not anyone decided so, and they are often run by other teams with weaker controls.

Pathwarden finds what the directory shows and asks you to decide (PW-025, PW-028). For the rest, list them in your configuration:

tier_zero = [
  "AADCONNECT01.SCALE.LOCAL",
  "VEEAM01.SCALE.LOCAL",
]

How Pathwarden protects it

Once Tier Zero is known, everything else follows:

• Attack paths are routes from outside Tier Zero into it. See attack paths.
• Accounts with an attack path to Tier Zero are the users and computers with such a route: the number to drive to 0. Tier Zero protected counts the Tier Zero objects no open attack path reaches. See exposure and Tier Zero protected.
• The remediation path is the fewest changes that cut every route. See the remediation path.
• pathwarden tier-zero -i <collection> lists every Tier Zero object and why it is there.

Other sets of systems can be protected the same way with Privilege Zones.

References

• Microsoft: Enterprise access model
• Microsoft: Securing privileged access
• SpecterOps: What is Tier Zero, part 1
• SpecterOps BloodHound docs: Tier Zero members
• ASD's ACSC, CISA, NSA and partners: Detecting and mitigating Active Directory compromises