[{"data":1,"prerenderedAt":517},["ShallowReactive",2],{"post-adtierkit-active-directory-tiering":3,"post-list":241},{"id":4,"title":5,"alsoIn":6,"body":7,"category":213,"date":214,"description":215,"draft":216,"extension":217,"image":218,"links":219,"meta":224,"navigation":225,"order":226,"path":230,"readingTime":206,"seo":231,"series":6,"stem":232,"strength":233,"tags":234,"unlisted":216,"updated":6,"__hash__":240},"posts\u002Fposts\u002Fadtierkit-active-directory-tiering.md","ADTierKit: Automatic AD-Tiering",null,{"type":8,"value":9,"toc":205},"minimark",[10,14,17,20,25,28,31,38,41,47,50,94,100,104,119,125,135,138,152,159,163,174,177,180,184,187,190,193,202],[11,12,13],"p",{},"I've built AD tier models by hand more than once, and every time it's the same grind. OUs, role groups, access groups, nesting them correctly, delegation, logon restriction GPOs, LAPS, silos. Hundreds of objects, tedious to create and easy to get wrong.",[11,15,16],{},"I went looking for something to take that off my hands. There are decent projects out there, but nothing that felt simple enough to just pick up and run. Either it was huge, or it wanted a specific setup, or I'd have spent longer understanding it than doing the work myself.",[11,18,19],{},"So I wrote my own. It's called ADTierKit.",[21,22,24],"h2",{"id":23},"what-it-is","What it is",[11,26,27],{},"One PowerShell script and one JSON file. Copy both onto a DC, run the script, answer some questions.",[11,29,30],{},"The wizard asks about your naming convention and resolves the patterns as you type, so you see real object names before you commit to anything:",[11,32,33],{},[34,35],"img",{"alt":36,"src":37},"The wizard asking for domain, tier count and naming patterns","\u002Fimages\u002Fposts\u002Fadtierkit-active-directory-tiering\u002Fwizard.webp",[11,39,40],{},"Then it shows you the whole thing before it touches the directory. Every OU, every group with a note on what it's for, the accounts, the GPOs.",[11,42,43],{},[34,44],{"alt":45,"src":46},"Preview of every object before anything is written","\u002Fimages\u002Fposts\u002Fadtierkit-active-directory-tiering\u002Fwizard-preview.webp",[11,48,49],{},"Say yes and you get the scaffolding:",[51,52,53,57,60,63,66,76,83,86],"ul",{},[54,55,56],"li",{},"the OU tree",[54,58,59],{},"role and access groups per tier, nested AGDLP style",[54,61,62],{},"delegation, so each tier admin manages their own branch",[54,64,65],{},"logon restriction GPOs",[54,67,68,75],{},[69,70,74],"a",{"href":71,"rel":72},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fidentity\u002Flaps\u002Flaps-concepts-overview",[73],"nofollow","Windows LAPS"," with a separate decryption principal per tier",[54,77,78],{},[69,79,82],{"href":80,"rel":81},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fsecurity\u002Fcredentials-protection-and-management\u002Fauthentication-policies-and-authentication-policy-silos",[73],"Kerberos authentication policy silos",[54,84,85],{},"SACL auditing",[54,87,88,89,93],{},"a few domain-wide bits, like ",[90,91,92],"code",{},"ms-DS-MachineAccountQuota"," set to zero",[11,95,96],{},[34,97],{"alt":98,"src":99},"The resulting OU structure in Active Directory Users and Computers","\u002Fimages\u002Fposts\u002Fadtierkit-active-directory-tiering\u002Fresult-aduc.webp",[21,101,103],{"id":102},"three-things-i-care-about","Three things I care about",[11,105,106,110,111,114,115,118],{},[107,108,109],"strong",{},"It plans first."," ",[90,112,113],{},"-Mode Deploy"," shows you what it would do and changes nothing. You need ",[90,116,117],{},"-Apply"," before a single object gets written. A mistyped command line can't touch your directory.",[11,120,121,124],{},[107,122,123],{},"It's idempotent."," Run it again against a domain that's already set up:",[126,127,133],"pre",{"className":128,"code":130,"language":131,"meta":132},[129],"language-text","Created: 0 | Updated: 0 | Already compliant: 205 | Failed: 0\n","text","",[90,134,130],{"__ignoreMap":132},[11,136,137],{},"Every stage recognises its own work, so the report only shows you what changed.",[11,139,140,143,144,147,148,151],{},[107,141,142],{},"It keeps things current."," This is the part I wrote it for. Deployment is a one-off, membership isn't. Move a server into a tier OU and it doesn't join the authentication silo. Nothing in AD tells you. ",[90,145,146],{},"-Mode Sync"," re-runs just the membership bits, and ",[90,149,150],{},"-Mode InstallTask"," puts that on a daily schedule.",[11,153,154,155,158],{},"There's also ",[90,156,157],{},"-Mode Audit",", which is read-only and grades what it finds by severity, and spits out a self-contained HTML report you can email to someone.",[21,160,162],{"id":161},"one-warning","One warning",[11,164,165,166,169,170,173],{},"Logon rights are tattooed. Once a restriction has applied, unlinking the GPO does ",[107,167,168],{},"not"," give the right back. The entry sits in the machine's local security database and survives reboots. You fix it with ",[90,171,172],{},"secedit",", locally, which means you need to already be on the box.",[11,175,176],{},"I found that out the way you'd expect, on a lab DC, late in the evening.",[11,178,179],{},"So now the tool checks before it writes. A deny group could take away logon rights from the account running the deployment, or from the built-in Administrator, on a machine you'd need in order to undo it. In that case the GPO stage doesn't run, and the tool tells you exactly which policy and which group. There's a second script for recovery too, in case someone gets there anyway.",[21,181,183],{"id":182},"where-it-stands","Where it stands",[11,185,186],{},"Lab-tested end to end against a Server 2025 domain, all modes, and the tier separation checked in both directions with real accounts. Not production-tested, no automated test suite, no second pair of eyes on the code yet. Treat it accordingly and take a snapshot first.",[11,188,189],{},"It builds the tier boundary and keeps it correct, and that's the whole scope. AppLocker or BitLocker baselines you still do yourself.",[11,191,192],{},"The full documentation is in the repo: every stage, the configuration reference, the rollout order I'd recommend, and what to do if it does lock you out:",[11,194,195],{},[107,196,197],{},[69,198,201],{"href":199,"rel":200},"https:\u002F\u002Fgithub.com\u002FNobrac\u002FADTierKit",[73],"github.com\u002FNobrac\u002FADTierKit",[11,203,204],{},"MIT licensed. If you use it, I'd like to hear how it went.",{"title":132,"searchDepth":206,"depth":206,"links":207},3,[208,210,211,212],{"id":23,"depth":209,"text":24},2,{"id":102,"depth":209,"text":103},{"id":161,"depth":209,"text":162},{"id":182,"depth":209,"text":183},"tools","2026-08-06","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.",false,"md","\u002Fimages\u002Fposts\u002Fadtierkit-active-directory-tiering\u002Fcover.webp",[220],{"title":221,"description":222,"website":199,"image":223},"ADTierKit on GitHub","One PowerShell script, one JSON file. MIT licensed.","https:\u002F\u002Fgithub.githubassets.com\u002Fimages\u002Fmodules\u002Flogos_page\u002FGitHub-Mark.png",{},true,[227,228,229],"The tier model, scaffolded","LAPS and auth silos","Keeping membership in sync","\u002Fposts\u002Fadtierkit-active-directory-tiering",{"title":5,"description":215},"posts\u002Fadtierkit-active-directory-tiering","2",[235,236,237,238,239],"active-directory","windows-server","powershell","tiering","laps","YyXqaWe8MIuOmyRTWFLFCf35iZH7So0-8fleq-hfk5k",[242,255,266,275,283,290,299,301,307,315,322,332,339,347,354,360,367,373,379,387,399,406,414,420,427,433,439,446,452,458,464,470,477,483,489,497,504,511],{"path":243,"title":244,"description":245,"date":246,"category":213,"alsoIn":247,"series":6,"tags":249,"readingTime":254},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16",[248],"windows",[248,250,251,252,253],"lsa","2fa","credential-provider","security",9,{"path":256,"title":257,"description":258,"date":259,"category":248,"alsoIn":260,"series":261,"tags":262,"readingTime":265},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[213],"Doppio · 3-part series",[248,250,263,264,251,253],"ntlm","smb",35,{"path":267,"title":268,"description":269,"date":270,"category":213,"alsoIn":6,"series":6,"tags":271,"readingTime":274},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[235,236,237,272,263,273],"hardening","kerberos",5,{"path":276,"title":277,"description":278,"date":279,"category":213,"alsoIn":6,"series":6,"tags":280,"readingTime":282},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[235,263,273,281,236],"auditing",6,{"path":284,"title":285,"description":286,"date":287,"category":248,"alsoIn":6,"series":261,"tags":288,"readingTime":289},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[248,252,250,251,253],32,{"path":291,"title":292,"description":293,"date":294,"category":248,"alsoIn":295,"series":261,"tags":296,"readingTime":298},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[213],[248,252,251,297,253],"totp",60,{"path":230,"title":5,"description":215,"date":214,"category":213,"alsoIn":6,"series":6,"tags":300,"readingTime":206},[235,236,237,238,239],{"path":302,"title":303,"description":304,"date":214,"category":235,"alsoIn":6,"series":6,"tags":305,"readingTime":306},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],11,{"path":308,"title":309,"description":310,"date":311,"category":312,"alsoIn":6,"series":6,"tags":313,"readingTime":206},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[314],"tor",{"path":316,"title":317,"description":318,"date":319,"category":235,"alsoIn":6,"series":6,"tags":320,"readingTime":321},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[273],1,{"path":323,"title":324,"description":325,"date":326,"category":327,"alsoIn":6,"series":6,"tags":328,"readingTime":331},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[327,329,330],"exchange-se","exchange-2019",47,{"path":333,"title":334,"description":335,"date":336,"category":235,"alsoIn":6,"series":6,"tags":337,"readingTime":254},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[263,235,338],"authentication",{"path":340,"title":341,"description":342,"date":343,"category":235,"alsoIn":6,"series":6,"tags":344,"readingTime":346},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[345],"adfs",4,{"path":348,"title":349,"description":350,"date":351,"category":235,"alsoIn":6,"series":6,"tags":352,"readingTime":206},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[353],"pass-the-hash",{"path":355,"title":356,"description":357,"date":358,"category":235,"alsoIn":6,"series":6,"tags":359,"readingTime":282},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[273],{"path":361,"title":362,"description":363,"date":364,"category":248,"alsoIn":6,"series":6,"tags":365,"readingTime":206},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[366],"credential-guard",{"path":368,"title":369,"description":370,"date":371,"category":248,"alsoIn":6,"series":6,"tags":372,"readingTime":346},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[366],{"path":374,"title":375,"description":376,"date":371,"category":248,"alsoIn":6,"series":6,"tags":377,"readingTime":206},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[378],"osconfig",{"path":380,"title":381,"description":382,"date":383,"category":248,"alsoIn":6,"series":6,"tags":384,"readingTime":206},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[385,386],"iis","modsecurity",{"path":388,"title":389,"description":390,"date":391,"category":235,"alsoIn":6,"series":6,"tags":392,"readingTime":398},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[393,394,395,396,397],"ad-cs","pki","vmware","vcsa","vcenter",10,{"path":400,"title":401,"description":402,"date":403,"category":235,"alsoIn":6,"series":6,"tags":404,"readingTime":405},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[393,394],36,{"path":407,"title":408,"description":409,"date":410,"category":411,"alsoIn":6,"series":6,"tags":412,"readingTime":398},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19","hack-the-box",[413,248,235],"writeup",{"path":415,"title":416,"description":417,"date":418,"category":235,"alsoIn":6,"series":6,"tags":419,"readingTime":209},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":421,"title":422,"description":423,"date":424,"category":411,"alsoIn":6,"series":6,"tags":425,"readingTime":426},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[413,312],12,{"path":428,"title":429,"description":430,"date":431,"category":411,"alsoIn":6,"series":6,"tags":432,"readingTime":254},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[413,312],{"path":434,"title":435,"description":436,"date":437,"category":411,"alsoIn":6,"series":6,"tags":438,"readingTime":321},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[413,248,235],{"path":440,"title":441,"description":442,"date":443,"category":411,"alsoIn":6,"series":6,"tags":444,"readingTime":445},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[413,312],7,{"path":447,"title":448,"description":449,"date":450,"category":411,"alsoIn":6,"series":6,"tags":451,"readingTime":206},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[413,312],{"path":453,"title":454,"description":455,"date":456,"category":411,"alsoIn":6,"series":6,"tags":457,"readingTime":321},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[413,312],{"path":459,"title":460,"description":461,"date":462,"category":411,"alsoIn":6,"series":6,"tags":463,"readingTime":206},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[413,312],{"path":465,"title":466,"description":467,"date":468,"category":411,"alsoIn":6,"series":6,"tags":469,"readingTime":346},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[413,312],{"path":471,"title":472,"description":473,"date":474,"category":411,"alsoIn":6,"series":6,"tags":475,"readingTime":274},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[413,476],"freebsd",{"path":478,"title":479,"description":480,"date":481,"category":411,"alsoIn":6,"series":6,"tags":482,"readingTime":306},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[413,248],{"path":484,"title":485,"description":486,"date":487,"category":411,"alsoIn":6,"series":6,"tags":488,"readingTime":206},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[413,248],{"path":490,"title":491,"description":492,"date":493,"category":312,"alsoIn":6,"series":6,"tags":494,"readingTime":321},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[495,496],"ssh","monitoring",{"path":498,"title":499,"description":500,"date":501,"category":411,"alsoIn":6,"series":6,"tags":502,"readingTime":503},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[413,248,235],16,{"path":505,"title":506,"description":507,"date":508,"category":327,"alsoIn":6,"series":6,"tags":509,"readingTime":321},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[510,237],"m365",{"path":512,"title":513,"description":514,"date":515,"category":327,"alsoIn":6,"series":6,"tags":516,"readingTime":321},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195054143]