v1.0.0
ADTierKit 1.0.0
Deploys and maintains an Active Directory administrative tier model — OU structure, AGDLP groups,
granular delegation, logon restriction policies, Windows LAPS and Kerberos authentication policy
silos — from one JSON configuration, idempotently, with -WhatIf support throughout.
Deployed and exercised against a Windows Server 2019, 2022 and 2025 lab domain: 238 objects, 0 failures, 0
created on the second run.
What's in this release
Roles. A role is not one object — it is a group, a template account, a set of ACEs, a
membership in the deny logon group of every other tier, and a membership in the tier's
authentication silo. Four of those five are easy to forget, and forgetting the deny nesting means
the new group can log on everywhere, which is exactly the boundary the model exists to draw. The
roles block declares it once and generates all of it.
Two roles ship ready to use. The Group Policy one grants write access to gpLink and read only to
gpOptions — the GPMC permission called Link GPOs grants both, and write access to gpOptions
is the ability to block inheritance and cancel out the baseline. The DNS one holds its permissions
by being nested into DnsAdmins, which stays empty of direct members and is now watched.
Ownership enforcement. An owner holds WRITE_DAC implicitly, so every object a delegated
administrator creates is one whose permissions they can rewrite — the granular delegation is
binding only until somebody creates something. The new stage reports it, and optionally corrects
it.
Per-policy Group Policy delegation, six new OU references for targets outside the tier model,
SACL coverage on CN=Policies, AdminSDHolder and CN=MicrosoftDNS, and offline test suites.
Upgrading
There is nothing to upgrade from — this is the first tagged release. A configuration written from
an earlier commit needs Update-TierConfiguration.ps1, which adds the new keys without touching
anything that already exists and refuses to guess where guessing would be unsafe.
One thing worth reading
The lab run found seven defects, and the expensive one was this: Set-ADObject on
nTSecurityDescriptor writes the DACL and drops the owner portion silently. The ownership
stage reported a correction on every run while the owner never changed. It was caught by running
the same enforce stage twice and noticing the same object drift again.
Owner writes now read back and compare before reporting anything as corrected, and the habit is
worth keeping by hand too: run enforce operations twice and expect zero the second time. A
security tool that reports a control it did not apply is worse than one that reports nothing,
because it stops anyone from looking.
Requirements
Windows PowerShell 5.1, the ActiveDirectory and GroupPolicy modules, Domain Admin, and a domain at
functional level 2016 or higher for authentication policy silos.
Not covered
No production directory, no multi-domain forest, no second engineer's review, no code signing. The
offline suites in tests/ cover configuration logic against mocks, not a directory — they would
not have caught any of the seven defects the lab run found. See
Limitations & notes.