The Active Directory Tiered Administration Model Explained
The Active Directory tiered administration model blocks a common path from credential exposure on a compromised workstation to Domain Admin. It separates privileged accounts and systems by scope of control, then enforces logon boundaries so a privileged credential can authenticate only from an approved system. Dedicated accounts and hardened administrative workstations carry most of the weight. A domain admin signs in to a user's laptop to fix a printer problem.