๐ Secure Bits ๐ก
๐ก๐ฒ๐ ๐ผ๐ณ๐ณ๐ถ๐ฐ๐ถ๐ฎ๐น ๐ง๐ถ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ ๐ผ๐ฑ๐ฒ๐น ๐ด๐๐ถ๐ฑ๐ฒ ๐ณ๐ฟ๐ผ๐บ ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐!
Really, not a joke! I was not expecting to live long enough to see something like this.
Jokes aside, a few months ago Microsoft published not only new ๐ฑ๐ผ๐ฐ๐๐บ๐ฒ๐ป๐๐ฎ๐๐ถ๐ผ๐ป calledย โTier model for Active Directory Domain Servicesโ, but earlier this year also a ๐๐ถ๐๐๐๐ฏ ๐ฝ๐ฟ๐ผ๐ท๐ฒ๐ฐ๐ calledย ActiveDirectoryTierModel.
๐ง๐ต๐ฒ ๐ฝ๐ฟ๐ผ๐ท๐ฒ๐ฐ๐ ๐ฐ๐ผ๐ป๐๐ฎ๐ถ๐ป๐ ๐๐๐ผ ๐บ๐ฎ๐ถ๐ป ๐ฃ๐ผ๐๐ฒ๐ฟ๐ฆ๐ต๐ฒ๐น๐น ๐๐ฐ๐ฟ๐ถ๐ฝ๐๐:
1๏ธโฃ ๐๐ฒ๐ฝ๐น๐ผ๐-๐ง๐ถ๐ฒ๐ฟ๐ ๐ผ๐ฑ๐ฒ๐น.๐ฝ๐๐ญ
This script helps you build the Tiering Model and prepares much more than just a basic OU structure. It can deploy:
โช๏ธ Organizational Units
โช๏ธ Security groups
โช๏ธ Administrative and service accounts
โช๏ธ OU ACL delegations
โช๏ธ Group Policy Objects and links
โช๏ธ Security Baselines
โช๏ธ ADMX templates
โช๏ธ MSA, gMSA, and dMSA ACL delegations
โช๏ธ Windows LAPS ACL delegations and optional LAPS deployment
โช๏ธ Kerberos Armoring support
The deployment can be performed component by component or as a full deployment. Each component follows the same useful process:
Plan โ Deploy โ Audit
The important part is that the invasive configurations and settings are not simply enabled without your control. You can review the plan, deploy individual components, test the result, and continue gradually.
2๏ธโฃ ๐๐๐ฑ๐ถ๐-๐ง๐ถ๐ฒ๐ฟ๐ ๐ผ๐ฑ๐ฒ๐น.๐ฝ๐๐ญ
This script audits the deployment and checks whether the environment still matches the Tiering Model configuration. It can audit individual components or the full deployment, including OU structure, groups, users, ACLs, GPOs, ADMX templates, managed service account delegations, and Windows LAPS configuration.
So far, I have only played with both scripts a little, but I am genuinely ๐ต๐ฎ๐ฝ๐ฝ๐ ๐๐ผ ๐๐ฒ๐ฒ ๐๐ต๐ถ๐ ๐
After all these years of Active Directory, this is quite an advancement, especially when many of the older Microsoft Tiering Model resources and links are no longer available. There is ๐ป๐ผ๐ ๐ฎ๐ป ๐ผ๐ณ๐ณ๐ถ๐ฐ๐ถ๐ฎ๐น, documented, and testable starting point for implementing the Tiering Model.
(๐ข๐ฎ ๐ ๐ค๐ฐ๐ฎ๐ช๐ฏ๐จ ๐ญ๐ข๐ต๐ฆ ๐ต๐ฐ ๐ต๐ฉ๐ฆ ๐ฑ๐ข๐ณ๐ต๐บ, ๐ฉ๐ฐ๐ธ ๐ญ๐ฐ๐ฏ๐จ ๐ฉ๐ข๐ด ๐ต๐ฉ๐ช๐ด ๐ฃ๐ฆ๐ฆ๐ฏ ๐ข๐ณ๐ฐ๐ถ๐ฏ๐ฅ?)
Have you already tested the project?
