Trusts & Forest Design
ESAE Red Forest vs the enterprise access model in 2026
Why Microsoft retired ESAE as the default, what the enterprise access model asks you to build instead, and when a bastion forest or PAM trust still makes sense.
Advanced
Guides tagged
#privileged-access
Tier 0 & Privileged Access
Authentication policies and silos for Tier 0 accounts
Restrict where Tier 0 admins can authenticate with AD authentication policies and silos: prerequisites, claims, TGT lifetime, audit mode and enforcement.
Advanced
Tier 0 & Privileged Access
Building privileged access workstations (PAWs) for AD
Design and build PAWs for Tier 0 admins: hardware, clean image, App Control allowlisting, no internet or email, and when a jump server is not enough.
Intermediate
Tier 0 & Privileged Access
Identify Tier 0 assets: a complete AD inventory method
Inventory every Tier 0 asset in Active Directory: DCs, AD CS, Entra Connect, backup, hypervisors, and the groups and ACLs that give indirect control.
Foundation
Tier 0 & Privileged Access
Tier 0 and privileged access: locking down Domain Admins
Build a working Tier 0 boundary in Active Directory with separate admin accounts, logon restrictions, PAWs, and authentication policy silos.
Foundation