Privileged Access Workstation Hardening: Tier 0 Admin Done Right
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
A Privileged Access Workstation is the answer to a specific attack pattern: an attacker compromises a regular admin's daily-driver workstation through email or browser exploit, then waits for the admin to RDP into a domain controller with their privileged account. The credentials are stolen from memory, and the attacker pivots to Tier 0. The PAW breaks this chain by ensuring that privileged credentials never touch a machine that can be compromised through normal user activities.
The Microsoft Enterprise Access Model defines three tiers: Tier 0 is the identity infrastructure (domain controllers, ADFS, Azure AD Connect, PIM, anything that can grant admin elsewhere), Tier 1 is server administration, Tier 2 is workstation administration and helpdesk. A PAW is designed for Tier 0 access only; Tier 1 admins get a different, less restrictive workstation. Mixing tiers on a single PAW defeats the entire model.
This guide assumes you are deploying PAWs for a population of 10 to 50 Tier 0 administrators. Smaller deployments may not justify the operational overhead; larger deployments need additional automation around provisioning that this guide does not cover. The Microsoft documentation is the canonical reference; this guide focuses on the practical decisions and tradeoffs that the documentation glosses over.
Hardware Selection Criteria
Treat the PAW as appliance hardware, not as a flexible workstation. Specify a model that lacks the features an attacker exploits and that meets baseline secure boot requirements. No built-in webcam or microphone: the PAW should be a typing terminal, not a meeting endpoint. If your standard fleet has webcams, source a different SKU or apply physical blockers (Yubico-style port blockers, opaque webcam covers, BIOS-disabled mic). Physical port restrictions: USB ports should be locked out via BIOS for storage class devices, allowing only HID (keyboard, mouse) and possibly smart card. If your administrators need YubiKeys, allow CCID class but no mass storage. TPM 2.0 with measured boot is non-negotiable: every PAW must have TPM 2.0, Secure Boot enabled, and ideally Pluton (on supported Microsoft Surface or AMD Pluton chipsets) for hardware-rooted key protection. Specify a model with a discrete TPM, not firmware TPM where possible. Modern enterprise SKUs from Dell (Precision, Latitude with Trusted Device), HP (EliteBook with Sure Start), and Lenovo (ThinkPad with ThinkShield) meet these requirements out of the box. Plan a hardware refresh cycle of 3 years, with retired PAWs going through certified destruction since they may have held sensitive metadata.
Operating System Hardening Specifics
Start from a Windows 11 Enterprise or Windows 10 LTSC image, not a standard corporate image. The PAW image is built from scratch with only the components a Tier 0 admin actually needs. Enable Secure Boot in UEFI with a UEFI admin password that's stored in your password vault, not known to the admin. Enable BitLocker with TPM+PIN protection; the PIN should be 8+ digits and different per admin. PIN-only is too weak; TPM-only allows boot without authentication. Remove all unnecessary software: no browsers (admins do not browse the web from the PAW), no Office, no email client, no Teams, no Slack. The only applications installed are the admin tools required for Tier 0 work: RSAT, mmc snap-ins, PowerShell with the AD and Azure AD modules, possibly a privileged session management client (CyberArk PSM, BeyondTrust). Credential Guard is mandatory; it isolates LSASS in a virtualization-based security container so credential theft tools can't read from memory. Device Guard with Windows Defender Application Control (WDAC) enforces application allowlisting; build a policy from the golden image that allows only the installed admin tools and signed Microsoft binaries. AppLocker as a fallback if WDAC adoption is slow. Disable Windows Hello PIN sync, Cortana, Windows Search indexing of network shares, and SMBv1. Apply CIS Benchmark Level 2 settings via Group Policy.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Network Isolation and Routing
Network isolation is what makes the PAW a PAW. Three rules: no internet browsing from the PAW, no split-tunneling on any VPN, no shared network with non-PAW devices. Implement via a dedicated PAW VLAN with strict firewall rules. From the PAW VLAN, allow outbound only to: Tier 0 management endpoints (domain controllers on TCP 389/636/3389/5985/5986, ADFS servers, Azure AD endpoints on 443 via known IP ranges), patch management infrastructure (WSUS or SCCM), and the PAW management endpoints themselves. Block everything else. Microsoft publishes the IP ranges for Azure AD and Office 365 as JSON feeds; ingest these into your firewall ruleset and update weekly. For internet-required services (Azure AD authentication endpoints, Microsoft Update), route through a dedicated proxy that logs every connection and enforces a tight allowlist. Do not run the proxy on shared infrastructure with general-purpose user traffic. For PAWs that must access Azure resources, use Azure AD-joined devices with Conditional Access policies requiring compliant device + specific user + specific app. Block Azure portal access from non-PAW IP ranges via Conditional Access location policies. If administrators travel, provide PAW laptops with the same network restrictions applied via Always-On VPN; never let a PAW operate on an untrusted network without the VPN active.
Credential Hygiene on the PAW
The PAW is the only machine the Tier 0 admin account ever logs into. The Tier 0 admin account is never used on any other workstation, server, or service. Build the password policy to enforce this: Tier 0 accounts have 24-character generated passwords stored in CyberArk or BeyondTrust Privileged Password Vault, and the admin retrieves them via session brokering rather than knowing them directly. Never reuse a Tier 0 password as a Tier 1 or Tier 2 password; never reuse across admins. Disable credential caching where possible: Group Policy setting "Interactive logon: Number of previous logons to cache" set to 0 for PAWs (with the operational caveat that the admin cannot log in if DCs are unreachable; for Tier 0 work this is acceptable). The PAW admin should have a separate, lower-privilege account for any non-Tier-0 work on the PAW itself (patching, browsing internal management portals); the Tier 0 account is used only when actively administering Tier 0 systems and is signed out immediately after. Enable LSA Protection (RunAsPPL) to prevent unauthorized access to LSASS. Disable RDP into the PAW from non-PAW sources; allow only console logon and jump-host-style access for emergency support. Configure Protected Users group membership for all Tier 0 accounts; this disables NTLM, Kerberos AES weakening, and DES, and prevents credential delegation.
Monitoring the PAW Itself
The PAW is high-value and must be the most heavily monitored endpoint in the environment. Deploy Sysmon with the SwiftOnSecurity or Olaf Hartong configuration tuned tighter: log every process creation, every network connection, every file creation, every registry modification in HKLM. Forward all events to your SIEM in near-real-time (not the standard 5-minute batch). Build detections specifically for the PAW that would be noise on a regular workstation: any process not in the WDAC allowlist (this should be impossible if WDAC is enforced, but alert anyway as a defense-in-depth signal), any outbound connection to a destination not in the PAW network allowlist, any logon attempt with an account that is not the assigned admin, any disabled or stopped security service. Defender for Endpoint or your EDR of choice runs on the PAW with maximum sensitivity; tune false positives aggressively because the analyst workload is small (one alert per PAW per month is the target). Audit Group Policy applied to PAWs weekly to verify policy is current; drift on a PAW is a critical finding. Maintain a separate dashboard for PAW health: each PAW's last contact time, last successful patch, last GPO refresh, current admin assignment. If a PAW goes silent for more than 24 hours, investigate.
Operational Challenges and Tradeoffs
PAWs fail in production for operational reasons more often than technical reasons. Admins resist them because PAWs are inconvenient: a second laptop to carry, no browser for documentation lookup, no Slack for asking questions, no Outlook for the email that contained the change ticket. Plan for these. Provide each Tier 0 admin with a second non-PAW laptop for daily work (email, browsing, meetings), and require they use the PAW only for the actual privileged actions. The ratio is roughly 30 minutes per day of PAW use versus 7+ hours on the daily laptop; build the operational model around that ratio. Handle urgent access when the PAW is unavailable through a break-glass process: a small number of emergency PAW accounts stored in physical safes with sealed envelopes, retrievable with two-person integrity and full audit. Never allow a Tier 0 action from a non-PAW endpoint, even in emergencies; if the PAW is broken, ship a replacement. Build automation around PAW provisioning: Microsoft Endpoint Manager (Intune) Autopilot with a PAW-specific profile that wipes and re-images the device, ready in under 4 hours from new hardware to operational PAW. Maintain a hot spare PAW per 10 admins to handle failures without operational disruption. Measure adoption: percentage of Tier 0 actions that originated from a PAW. The target is 100%. Anything below 95% is a finding worth escalating.
The bottom line
Privileged Access Workstations are operationally expensive but represent the single highest-leverage control against the credential theft pattern that drives most major breaches. The cost is two laptops per Tier 0 admin plus the engineering effort to maintain the PAW image and policies; the benefit is that an attacker who compromises an admin's email or browser cannot pivot to domain admin.
Deploy in phases: identify your Tier 0 admin population (usually 5 to 20 people), build the PAW image and policies, pilot with two willing admins for 60 days, then expand. Measure adoption ruthlessly and treat any Tier 0 action originating off-PAW as a security event. The model only works if it's enforced; partial deployment provides false comfort without the security benefit.
Frequently asked questions
Can I use a virtual machine as a PAW instead of dedicated hardware?
Not for Tier 0. A VM running on the admin's daily-driver laptop inherits the compromise of the host; if the daily-driver is owned, the VM is owned. Microsoft's Secure Admin Workstation model with Windows Defender Application Guard provides some isolation for Tier 1 and Tier 2 admin work, but Tier 0 requires dedicated hardware. The alternative for some shops is Azure Virtual Desktop or Windows 365 Cloud PC with strict Conditional Access, accessed from a hardened client; this works if the client device itself is treated as a PAW.
How do I handle PAW patching without internet access?
Patches flow through WSUS or SCCM on a dedicated patch server in the PAW management zone. The patch server pulls updates from Microsoft via a tightly controlled proxy, validates signatures, and serves them to PAWs over the management network. Run patches on a 7-day cycle for critical, 14-day for important. Test on a pilot PAW (the security team's own PAW typically) before pushing to the rest of the fleet. Document patch state per PAW in the monitoring dashboard.
What's the right approach for cloud-only environments without on-prem Tier 0?
The PAW model still applies; the targets just shift. In Azure-only environments, Tier 0 includes Global Admins, Privileged Role Administrators, Conditional Access policies, and the tenant itself. PAWs access the Azure portal and Azure AD via Conditional Access policies that require Intune-compliant devices, specific user accounts, and trusted locations. Microsoft's secure workstation guidance for Azure AD admins is the reference. The hardware and OS hardening is the same; the network isolation focuses on restricting which Azure tenants and resources the PAW can reach.
How often should PAW images be rebuilt?
Rebuild the golden image quarterly to incorporate patches and policy updates. Reimage individual PAWs annually as a hygiene measure, even if no compromise is suspected; this resets any drift and reapplies the current policy baseline. After any suspected compromise of a PAW, reimage immediately and treat the previous image as evidence. Build the image with infrastructure-as-code (MDT, Intune Autopilot, or a similar tooling) so rebuilds are reproducible and auditable.
Can the same PAW be used by multiple administrators on different shifts?
Yes, but only with strong session isolation. Each admin has their own Windows account on the PAW, logs in at shift start, logs out at shift end. The Windows account is tied to a specific Tier 0 admin identity and never shared. Some shops issue PAWs per admin rather than shared; this is simpler operationally but doubles the hardware count. Shared PAWs work well for 24x7 SOCs with shift-based Tier 0 operations; per-admin PAWs work better for distributed admin teams. Either way, never share Windows accounts on the PAW between humans.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.