From the Field: Critical Roles

๐Ÿ”Ž ๐—™๐—ฟ๐—ผ๐—บ ๐˜๐—ต๐—ฒ ๐—™๐—ถ๐—ฒ๐—น๐—ฑ โ€” Real-World Findings from Security Assessments

๐Ÿ’ฅ ~๐Ÿฏ๐Ÿฌ%ย of environments I assessedย ๐˜€๐˜๐—ถ๐—น๐—น ๐—ฐ๐—ผ-๐—ต๐—ผ๐˜€๐˜ ๐—ฐ๐—ฟ๐—ถ๐˜๐—ถ๐—ฐ๐—ฎ๐—น ๐—ฟ๐—ผ๐—น๐—ฒ๐˜€ ๐—ถ๐—ป๐˜€๐˜๐—ฒ๐—ฎ๐—ฑ ๐—ผ๐—ณ ๐˜€๐—ฒ๐—ฝ๐—ฎ๐—ฟ๐—ฎ๐˜๐—ถ๐—ป๐—ด ๐˜๐—ต๐—ฒ๐—บ

๐—œ ๐˜€๐—ฒ๐—ฒ ๐˜๐—ต๐—ถ๐˜€ ๐—ฎ๐—น๐—น ๐˜๐—ต๐—ฒ ๐˜๐—ถ๐—บ๐—ฒ:

๐Ÿ”ธ DHCP on Domain Controllers (and yesโ€”there are someย nasty escalationย pathsย with default DHCP groups when hosted on a DC)

๐Ÿ”ธ AD CS on Domain Controllers

๐Ÿ”ธ Entra ID Connect co-hosted with other services

๐Ÿ”ธ โ€ฆand more

 

This isnโ€™t just โ€œmessy architectureโ€ โ€” it createsย ๐—ฟ๐—ฒ๐—ฎ๐—น ๐—ฎ๐˜๐˜๐—ฎ๐—ฐ๐—ธ ๐—ฝ๐—ฎ๐˜๐—ต๐˜€, and it also makes a proper Tiering Model / access restrictions almost impossible, because these roles often belong to different tiers.

โœ… In 2026, I reallyย struggle to find a good reasonย not to separate servicesโ€”at least for the security-critical ones.

Even if youโ€™re limited by licensing / VM counts, you can still design it sanely โ€” butย you ๐—ป๐—ฒ๐—ฒ๐—ฑ ๐˜๐—ผ ๐˜‚๐—ป๐—ฑ๐—ฒ๐—ฟ๐˜€๐˜๐—ฎ๐—ป๐—ฑ ๐˜๐—ต๐—ฒ ๐˜๐—ถ๐—ฒ๐—ฟ๐—ถ๐—ป๐—ด ๐—ฐ๐—ผ๐—ป๐—ฐ๐—ฒ๐—ฝ๐˜ ๐—ณ๐—ถ๐—ฟ๐˜€๐˜, otherwise youโ€™ll lock yourself into a risky setup.

(๐Ÿ”— short free intro here: https://academy.horizon-secured.com/p/windows-infrastructure-security-tiering-model)

๐Ÿ’ฌ Do you co-host services in your environment? If yesโ€”whatโ€™s the reason(cost, legacy, operational constraints)?