The real risk: one admin account used everywhere
In many small businesses, the same administrator account is used to manage a server, sign in to a user's workstation, open an office session and sometimes read email. It is convenient, but dangerous: if that account is compromised, the attacker can quickly take control of the domain.
What recent compromises reveal
An analysis of 47 major corporate compromises in 2025 shows that privileged credentials played a central role in 89% of cases. The Verizon 2025 Data Breach Investigations Report confirms the trend: credential theft and privilege abuse are among the leading compromise factors, with stolen credentials alone accounting for around 22% of confirmed breaches as the initial access vector.
The key figures:
Major compromises involving privileged credentials (2025 analysis): 89%.
Confirmed breaches with stolen credentials as the initial vector: around 22%.
Incidents involving internal users with excessive rights: 45%.
Incidents involving third parties with excessive privileged access: 34%.
The most destructive attack pattern usually follows a recognisable chain: initial access through phishing, local privilege escalation on the first compromised device, credential harvesting, lateral movement towards higher-value systems, then domain-level privilege escalation once an administrator credential has been obtained. With generative AI, this chain now unfolds in hours rather than weeks.
Active Directory tiering separates administration levels precisely to limit this lateral movement. The idea is simple: an account that administers the domain must never be used on an ordinary user workstation.
A pragmatic version for small businesses
There is no need to build an overly heavy architecture from day one. Start with three rules:
a standard named account for everyday work;
a separate administrator account for servers and services;
a highly privileged account, rarely used, for Active Directory and critical operations.
Then add dedicated administration workstations or sessions, MFA, strong passwords, clear logging and a regular review of privileged groups.
The priorities
Remove shared administrator accounts.
Withdraw unnecessary Domain Admin rights, bearing in mind that 45% of incidents involve internal users with rights exceeding their actual role.
Ban the use of admin accounts for email and web browsing.
Create separate accounts for each privilege level.
Protect admin accounts with MFA wherever possible.
Monitor sign-ins and changes to sensitive groups.
Document service accounts and their rights, paying particular attention to third-party access, involved in 34% of excessive-privilege incidents.
What to avoid
The risk is making administration so complex that teams work around the rules. The right level of security is the one that sharply reduces the risk while remaining usable. For a small business, a clear separation of accounts and uses already brings a huge gain.
Tiering must also come with a clean-up: dormant accounts, former suppliers, overly broad groups, scripts containing passwords, services running with too many privileges.
The three-tier model, explained simply
The tiering model formalised by Microsoft distinguishes three levels of sensitivity, a logic that carries over even in a lighter version for small businesses:
Tier 0 (the most critical): domain controllers, PKI infrastructure and any system able to administer the entire domain directly. A Tier 0 account must never sign in anywhere other than on these systems.
Tier 1 (intermediate): application servers, file servers, business infrastructure. Accounts at this level administer servers but have no rights over the directory itself.
Tier 2 (the most common): user workstations and office applications. This is where the standard everyday named account operates.
The absolute rule that makes this model effective: an account at a given tier must never authenticate on a system at a more sensitive tier than its own. It is precisely this rule, constantly broken by using a single admin account everywhere, that lets an attacker climb from a compromised user workstation to full control of the domain.
An example of a three-month progression
A realistic rollout for a small business usually follows this pace:
Month one: inventory of privileged accounts and removal of shared or dormant accounts.
Month two: creation of separate accounts per tier and MFA enabled on sensitive accounts.
Month three: logging put in place and the first regular review of privileged groups.
This progression avoids blocking teams overnight while quickly reducing the most critical risks.
The audit as a starting point
An Active Directory audit identifies risky accounts, dangerous delegations and likely attack paths. It then makes it possible to put in place a realistic model, suited to the team and to business constraints.
MFA and tiering do not replace each other
A common confusion is to believe that MFA makes tiering unnecessary. In reality the two protect against different things. MFA makes the initial compromise of an account harder: even with the password, the attacker comes up against the second factor. Tiering limits the damage once an account has fallen, by preventing a jump from an ordinary workstation to the heart of the domain. One closes the front door, the other partitions the house.
It is their combination that protects. An administrator account protected by MFA but used daily for email remains exposed to advanced phishing and session attacks: the second factor is no use if the attacker hijacks an already open session. Separating uses therefore remains essential, MFA or not.
The forgotten link: service accounts
Service accounts, those that run applications and automated tasks, are the classic blind spot of tiering. They generally cannot use MFA, often hold high rights inherited from an old installation, and their password, once set, is almost never changed. An attacker seeking to get round the protections deployed on human accounts turns precisely to them.
Handling them properly does not require sophisticated technology, but rigour: document each service account, its real use and its scope, remove superfluous rights, use a long, unique password, restrict its network access to what is strictly necessary and monitor its activity. A forgotten service account with domain administration rights is a back door that does not announce itself.
Start small, but start
Tiering has a bad reputation, that of an overengineered system reserved for large organisations. It is a misunderstanding: its pragmatic version, three account levels and one simple rule, already delivers most of the benefit to a small business, without excessive complexity. The real risk is not doing too much, but doing nothing and continuing to use an all-powerful account everywhere, offering an attacker the shortest path to full control of the domain.
An Active Directory audit remains the best starting point: it reveals risky accounts and attack paths, then makes it possible to build a realistic model. Our Security Audit package then helps prioritise these fixes.
Sources: OmniPriv, The Anatomy of a Privileged Account Compromise, 2025's Biggest Breaches · Microsoft Security Blog, Containing a domain compromise · Microsoft Learn, Enterprise access model