Glossary
Active Directory tier model
An administrative model that separates Tier 0 (identity), Tier 1 (servers) and Tier 2 (workstations) so privileged credentials are never exposed on less trusted systems.
The Active Directory tier model divides systems and admin accounts by the control they have over the environment. Tier 0 contains the identity plane: domain controllers, AD CS, AD FS, directory synchronisation and anything that controls them. Tier 1 contains member servers and applications, and Tier 2 contains workstations and user devices. The rule is that accounts only log on to systems in their own tier, so a compromised workstation never holds credentials that could control servers or the domain.
It is implemented with separate admin accounts, logon-restriction Group Policies (deny log on rights), Protected Users, privileged access workstations and, optionally, authentication policies and silos. Microsoft's enterprise access model extends the same idea to cloud control planes.