Skip to content
Hermes Codex

Administrative Boundaries in Windows and Active Directory: The Trust Model

Concept

Section titled “Concept”

A Security Boundary is an architectural perimeter within which a security system guarantees that an unauthorized entity outside cannot force access or modify internal assets without traversing a formally defended boundary.

In the Microsoft ecosystem, isolation follows a strict hierarchy:

  1. Process Boundary: Isolated by kernel virtual memory and Mandatory Integrity Control (MIC).
  2. Host Boundary: Isolated by the OS kernel and local SAM database.
  3. Domain Boundary: An administrative boundary facilitating management, but permeable within a forest.
  4. Forest Boundary: The ultimate Active Directory security boundary.
  5. The Enterprise Tiering Model: A logical architecture (Tier 0, Tier 1, Tier 2) preventing high-trust identities from exposing secrets to lower-trust assets.

Why This Matters in DFIR

Section titled “Why This Matters in DFIR”

Evaluating the blast radius of an intrusion depends on respecting these boundaries:

  • Preventing Unnecessary Domain-Wide Rebuilds: Compromising an isolated host (Tier 2) does not warrant rebuilding Active Directory, provided tiering boundaries were unbreached.
  • Evaluating Child Domain Compromise: If an adversary compromises a child domain (CHILD.CORP), responders must treat the entire forest (CORP.LOCAL) as potentially compromised (see Doc 12: Active Directory Forests, Trees and Domains).
  • Investigating Tier-Hopping Credentials: In most enterprise ransomware cases, attackers traverse from Tier 2 to Tier 0 because a Tier 0 administrator logged into an unhardened Tier 2 workstation.

Isolation Hierarchy

Section titled “Isolation Hierarchy”
┌─────────────────────────────────────────────────────────────────────────────┐
│ ACTIVE DIRECTORY FOREST (The True Security Boundary)                        │
│                                                                             │
│  ┌───────────────────────────────┐     ┌───────────────────────────────┐   │
│  │ Root Domain (CORP.LOCAL)      │◄───►│ Child Domain (FR.CORP.LOCAL)  │   │
│  │ (Administrative Boundary)     │     │ (Administrative Boundary)     │   │
│  └───────────────┬───────────────┘     └───────────────┬───────────────┘   │
│                  │                                     │                   │
│                  ▼                                     ▼                   │
│  ┌───────────────────────────────┐     ┌───────────────────────────────┐   │
│  │ Member Server (SRV01)         │     │ Member Server (SRV02)         │   │
│  │ (Host / SAM Boundary)         │     │ (Host / SAM Boundary)         │   │
│  └───────────────────────────────┘     └───────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────────────┘

The Enterprise Tiering Architecture

Section titled “The Enterprise Tiering Architecture”

To defend the environment, assets and identities are segmented into three airtight tiers:

               ┌────────────────────────────────────────────────────────┐
               │ TIER 0: Identity Control & Core Infrastructure         │
               │ Domain Controllers, PKI, ADFS, Azure AD Connect        │
               └───────────────────────────▲────────────────────────────┘
                                           │ (Down-tier logons strictly prohibited)
               ┌───────────────────────────┴────────────────────────────┐
               │ TIER 1: Enterprise Servers & Business Applications     │
               │ File servers, database servers, application clusters   │
               └───────────────────────────▲────────────────────────────┘
                                           │ (Down-tier logons strictly prohibited)
               ┌───────────────────────────┴────────────────────────────┐
               │ TIER 2: Endpoints & User Workstations                  │
               │ User laptops, workstations, network printers           │
               └────────────────────────────────────────────────────────┘

Golden Rule of Tiering:

Identities in a higher tier must NEVER log into or leave credentials on a lower-tier resource. A Domain Administrator (Tier 0) must never open an interactive or RDP session on an application server (Tier 1) or user laptop (Tier 2).

What Is Possible

Section titled “What Is Possible”
  • Building Dedicated Forests for Backups: A dedicated forest without trusts creates an airtight security boundary against domain-wide ransomware attacks.
  • Restricting Cross-Forest SIDs via SID Filtering: SID Filtering on forest trusts blocks unauthorized SID injection attacks.
  • Sanctuary Member Servers: Stripping domain groups from a member server’s local Administrators group protects it against domain compromise.

What Is Not Possible

Section titled “What Is Not Possible”
  • Guaranteeing Security Isolation Between Intra-Forest Domains: Microsoft documents that domains within the same forest do not represent security boundaries against hostile Domain Admins.
  • Protecting In-Memory Secrets on Compromised Hosts: If a Tier 0 account connects to a compromised Tier 2 workstation, LSASS credential theft is instantaneous.

Forensic Artifacts

Section titled “Forensic Artifacts”
  • Event ID 4624 (Logon Type 2 or 10): Tracking Tier 0 domain accounts logging into Tier 2 endpoints.
  • BloodHound Telemetry: Identifying HasSession edges connecting Tier 0 identities to Tier 2 machines.

Key Takeaways

Section titled “Key Takeaways”
  1. The forest is the ONLY true security boundary in Active Directory.
  2. The domain is an administrative and replication boundary, not an isolation boundary.
  3. The Tiering model strictly prohibits downward credential exposure.
  4. In-memory credential theft on lower tiers is the primary bridge to Tier 0 compromise.

Cross References

Section titled “Cross References”