What is activedirectorytiermodel?

Active Directory Tier Model is a Microsoft-built toolkit that helps IT and security teams set up a layered security structure inside Windows Active Directory environments. The "tier model" is a widely recommended approach where administrators and systems are separated into tiers, Tier 0 for the most sensitive domain controllers, Tier 1 for server admins, and Tier 2 for regular workstation admins, so that if a lower-tier account is compromised, attackers can't use it to climb up to more powerful systems. Instead of manually creating all the folders (organizational units), security groups, user accounts, permission rules, and group policies that a tiered setup requires, you describe everything you want in a single JSON configuration file. The framework reads that file and builds out the entire structure for you. You can run it again later and it will only change what's drifted from your intended configuration, leaving everything else untouched. A separate audit script checks whether your live environment still matches what the config file says it should. This is designed for enterprise IT administrators and security engineers who manage Active Directory at scale. For example, a security team rolling out tiering for the first time could use this to stand up the whole structure consistently, rather than relying on tribal knowledge or click-by-click manual work. It also integrates with Microsoft Sentinel for monitoring, so security operations teams get built-in detection rules without writing custom logic. You need to be a Domain Admin running PowerShell 7 or later, and currently both your machine and your Active Directory must be in English. The project is notably strict about contributions because it is a security tool. Any change must be discussed in an issue first and agreed upon before code is written, and pull requests without that prior agreement are simply closed. The maintainers are upfront that this is to prevent well-intentioned changes from accidentally weakening security boundaries. The codebase has extensive automated tests with 80% minimum coverage enforced by CI, and the framework supports "WhatIf" mode so you can preview exactly what would change before applying anything for real.