This approach allows the provisioning of accounts as standard non-privileged users in the administrative forest that are highly privileged in the production environment, enabling greater technical enforcement of governance. ESAE, or Enhanced Security Administrative Environment, is Microsoft’s complete framework to protect Active Directory (AD). Data represents desktop traffic only. The justification for the approval must include:Administrators are required to obtain permissions "just-in-time" to use them as they perform tasks. To eliminate these attacks without third-party tooling, Microsoft has developed and recommended new domain architectures using built-in AD features and Microsoft Identity Manager (MIM). Security zones can span both on-premises and cloud infrastructure, such as in the example where Domain Controllers and domain members in the same domain are hosted on-premises and in Azure.The Tier model prevents escalation of privilege by restricting what administrators can control and where they can log on (because logging on to a computer grants control of those credentials and all assets managed by those credentials).Control restrictions are shown in the figure below:Note that some assets can have Tier 0 impact to availability of the environment, but do not directly impact the confidentiality or integrity of the assets. Tier 1 administrator accounts have administrative control of a significant amount of business value that is hosted Many organizations overlook the risk of other groups that are effectively equivalent in privilege in a typical active directory environment. Whether credentials are exposed to potential theft on the target (remote) computer depends primarily on the windows logon type used by the connection method.This table includes guidance for the most common administrative tools and connection methods:For web authentication, use the reference from the table below:For management applications that are not in this table, you can determine the logon type from the logon type field in the audit logon events. All usage and duration of these privileges should be captured in the change approval board record after the task is completed.This section contains an approach for an administrative forest based on the Enhanced Security Administrative Environment (ESAE) reference architecture deployed by Microsoft's cybersecurity professional services teams to protect customers against cybersecurity attacks.Dedicated administrative forests allow organizations to host administrative accounts, workstations, and groups in an environment that has stronger security controls than the production environment.This architecture enables a number of security controls that aren't possible or easily configured in a single forest architecture, even one managed with Privileged Access Workstations (PAWs). advanced technologies and recommended practices to provide an administrative environment and workstations with enhanced security protection. For example if A controls B and B controls C, then A also indirectly controls C.An attacker that compromises A gets access to everything A controls (including B), and everything B controls (including C). For more information, see the "Automatically Approve Updates for Installation" section in Approving Updates.Ensure all media is validated using the guidance in Ensure the administrative forest servers should have the latest operating systems installed, even if this is not feasible in production.Admin forest hosts should be automatically updated with security updates.Windows Server Update Services can be configured to automatically approve updates. Just-in-time permissions provide the ability to:Use the following practices to proper manage risk of credential exposure.All personnel that are authorized to possess administrative privileges must have separate accounts for administrative functions that are distinct from user accounts.Before an administrator can log on to a host interactively (locally over standard RDP, by using RunAs, or by using the virtualization console), that host must meet or exceed the standard for the admin account Tier (or a higher Tier).Administrators can only sign in to admin workstations with their administrative accounts. The only authorized exceptions are the emergency access accounts that are protected by the appropriate processes.Link all administrative accounts to a smart card and enable the attribute "A script should be implemented to automatically and periodically reset the random password hash value by disabling and immediately re-enabling the attribute "Allow no exceptions for accounts used by human personnel beyond the emergency access accounts.All accounts with administrative privileges in a cloud service, such as Microsoft Azure and Office 365, must use multi-factor authentication.Operational practices must support the following standards:Ensure that each emergency access account has a tracking sheet in the safe.The procedure documented on the password tracking sheet should be followed for each account, which includes changing the password after each use and logging out of any workstations or servers used after completion.All use of emergency access accounts should be approved by the change approval board in advanced or after-the-fact as an approved emergency usage.Only authorized domain admins can access the emergency access accounts with domain admin privileges.The emergency access accounts can be used only on domain controllers and other Tier 0 hosts.Forest-wide tasks that require enterprise administrative privilegesTopology management including Active Directory site and subnet management is delegated to limit the use of these privileges.All usage of one of these accounts should have written authorization by the security group leadThe procedure on the tracking sheet for each emergency access account requires the password to be changed for each use. The Tier model is composed of three levels and only includes administrative accounts, not standard user accounts:Direct Control of enterprise identities in the environment. AD controls your access to resources … Administrators only log on to managed resources by using the approved support technology described in the next section.This is required because logging onto a host interactively grants control of the credentials to that host.Administrators who support remote systems and users must follow these guidelines to prevent an adversary in control of the remote computer from stealing their administrative credentials.Ensure that the following practices are applied for this scenario:If you have a Tier 0 privilege management solution, add "that uses permissions obtained just-in-time from a privileged access management solution.
At least one administrative account should be password based to ensure access will work in case the multi-factor authentication process breaks.