Privileged Access Workstation Design: How to Build a PAW Environment That Actually Protects Tier 0 Admin Accounts
Proactive Security for the AI Era
NodeZero continuously and autonomously pentests infrastructure, identity, cloud, and now web applications, chaining weaknesses across every domain the way real attackers do. Every finding ships with replayable proof showing exploitable business impact, not theoretical risk.
The most common path to Domain Admin in enterprise incidents is not a sophisticated exploit. It is a phishing email opened on the same laptop where the admin also runs RDP sessions to domain controllers. The credential is harvested from the browser or LSASS, and the rest is lateral movement. A Privileged Access Workstation breaks this exposure by creating a physical and logical separation between the admin's standard user activity and their privileged operations. This guide covers how to design one that actually delivers that separation.
What a PAW Must Provide and What It Cannot Fix
A PAW is effective against a specific threat model: malware on the admin's standard workstation harvesting credentials used for privileged operations. It is not a silver bullet.
A PAW eliminates:
- Credential theft from a browser-stored admin password or LSASS credential dump on the user's primary device
- Man-in-the-browser attacks against RDP or web admin interfaces opened from the user's primary device
- Malware keylogging on the device where admin passwords are typed
A PAW does not eliminate:
- Compromise of the PAW device itself (physical or malware)
- Admin performing privileged work from the standard workstation because the PAW is inconvenient
- Social engineering attacks that manipulate the admin into performing a privileged action (the admin is still the human in the loop)
- Attacks originating from the target system (a compromised DC can attack back through an open RDP session)
The PAW only works if it is used. User adoption failure is the most common PAW implementation failure. Design with usability in mind from the start.
Hardware and Physical Security Requirements
PAW hardware requirements differ from standard laptop procurement:
TPM 2.0 required: BitLocker full-disk encryption backed by TPM 2.0 is the baseline. Without TPM, disk encryption keys can be extracted from hibernation files. Verify TPM version before purchase: Get-WmiObject Win32_Tpm -Namespace root/cimv2/security/microsofttpm | Select-Object SpecVersion
UEFI Secure Boot enabled and locked: Configure UEFI passwords and disable legacy boot. Secure Boot prevents unsigned OS components from loading, blocking many bootkit and rootkit attacks. Lock UEFI settings with a hardware password distinct from any operating system credential.
No integrated webcam or microphone (preferred): Reduces attack surface. If the device will be used for video calls (which it should not be on a true PAW), document the exception.
Physical security: PAWs should be stored in a locked location when not in use. Label them clearly as privileged devices and prohibit them from leaving secured facilities. Implement a check-out log for shared PAW pools.
Virtual PAW option: For organizations that cannot justify physical PAWs for all admins, a dedicated VM on a hardened hypervisor with network isolation is an acceptable intermediate control. The VM must be on a host that is not accessible from general user networks and must not share the hypervisor with standard user VMs.
Recommended build: Windows 11 Enterprise, UEFI with Secure Boot, BitLocker with TPM 2.0, no standard user accounts on the device, domain-joined to the admin-tier OU, and managed exclusively via the PAW GPO.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
GPO Hardening Baseline for PAWs
Apply a dedicated GPO to the PAW OU. The PAW GPO must be enforced and must not allow inheritance blocking from child OUs. Key settings:
Restrict logon rights: Only Tier 0 admin accounts should be permitted to log on to PAWs. Configure User Rights Assignment:
- Allow log on locally: PAW-Admins group only
- Allow log on through Remote Desktop Services: Disabled
- Deny log on locally: Domain Users, Authenticated Users
Block internet access at the host level: Configure Windows Firewall outbound rules to block all outbound traffic except to the admin management subnets and authentication services (DCs, ADFS/Entra ID, NPS). No general internet browsing from the PAW.
Disable removable media: Via Group Policy, configure Removable Disks: Deny write access and Removable Disks: Deny read access (Computer Configuration > Administrative Templates > System > Removable Storage Access). Exception process required for emergency offline tools.
Disable browser access to non-admin sites: If a browser must be present for web admin consoles, configure browser proxy settings to restrict outbound destinations to the approved management IP ranges only.
Enable Credential Guard: Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security. Credential Guard isolates LSASS credentials in a hypervisor-protected memory region, preventing standard credential dump tools.
Application control via WDAC: Windows Defender Application Control policy allowing only signed Microsoft components and your approved admin tools. Block PowerShell interactive console for non-admin users on the PAW (admins will use constrained language mode via WDAC).
Audit and log everything: Enable Advanced Audit Policy for Logon, Privilege Use, Process Creation, and Object Access. Forward all logs to the SIEM via a management-plane connection.
Network Architecture: Isolating the PAW Subnet
Network isolation is as important as the host hardening. A PAW connected to the same network as standard user workstations provides weak isolation because network-based attacks can still reach it.
PAW network requirements:
Dedicated VLAN: PAWs operate in a dedicated VLAN accessible only from the admin management plane. No east-west traffic permitted from the user VLAN to the PAW VLAN.
Firewall rules from the PAW VLAN: Permitted outbound destinations only include:
- Domain Controllers (Kerberos, LDAP, LDAPS ports)
- PAM solution servers (CyberArk, BeyondTrust, Delinea)
- WSUS/SCCM for updates (management server only, not general internet Windows Update)
- DNS server (internal DNS, not public resolvers)
- SIEM log collector
- Target management interfaces (DC admin, server admin consoles)
Block all other outbound from the PAW VLAN. No internet routing.
Inbound to PAW VLAN: No inbound connections from standard user VLANs. Inbound from management monitoring systems (vulnerability scanner, SIEM collector) permitted.
Jump server vs. PAW: Jump servers (bastion hosts) are an alternative where admins RDP from their standard workstation to a hardened jump server, and from there to target systems. Jump servers are better than nothing but do not eliminate credential exposure on the standard workstation where the RDP client runs. A PAW with direct admin connections is stronger. If both are deployed, the PAW should connect directly to target systems, bypassing the jump server.
Common PAW Implementation Shortcuts That Defeat the Purpose
Each of these shortcuts is common and each breaks the security model:
Allowing admin email on the PAW: Email is the primary malware delivery mechanism. If admins receive and open email on the PAW, the PAW has the same attack surface as a standard user laptop. Email must be prohibited on PAWs. Admins needing to respond to admin-related email use their standard user device and initiate privileged tasks from the PAW separately.
Shared PAW accounts: Assigning a single generic account (paw-admin01) shared among multiple admins eliminates accountability and makes the PAW OU impossible to properly scope. Each admin must have an individual Tier 0 admin account bound to their person, not shared.
Installing admin tools that require internet connectivity: Some admin tools (cloud management consoles, vendor portals) require outbound HTTPS to vendor infrastructure. Installing these on the PAW requires internet access, breaking the isolation. Use a separate device or a browser-in-browser isolation solution for cloud vendor consoles. Do not open internet access on the PAW.
Using the PAW for non-privileged work during slow periods: Admins who need to stay productive while waiting for privileged tasks will use the PAW for general work if it is their only available device. Issue both a standard user laptop AND a PAW to every admin who needs one. The standard laptop handles all general-purpose work; the PAW is powered on only for privileged operations.
The bottom line
A PAW is only effective if it is used consistently and configured to prevent workarounds. The hardware and GPO configuration are straightforward. The hard part is user adoption and stopping the gradual erosion of controls when admins find them inconvenient. Start with your highest-privilege admins (Domain Admins, Enterprise Admins, Tier 0 service account managers), get them on PAWs first, document the process, then expand to Tier 1. Measure adoption by checking logon events to domain controllers from non-PAW source IPs.
Frequently asked questions
Can a VM be used as a PAW instead of a dedicated physical device?
Yes, with conditions. The VM hypervisor host must be dedicated to PAW use or at minimum isolated from general-purpose VMs. The hypervisor host must be on the PAW network segment with no management access from standard user VLANs. The VM must have TPM 2.0 passthrough for BitLocker, and the hypervisor must have Secure Boot enabled. A VM on a shared hypervisor accessible from user VLANs provides minimal additional protection because hypervisor-level attacks or a compromised co-located VM can access PAW VM memory.
What is the difference between a PAW and a jump server?
A jump server (bastion host) is a shared, hardened server that admins RDP to from their standard workstations before connecting to target systems. A PAW is a dedicated workstation assigned to a specific admin. The key difference is credential exposure: when an admin RDPs from a standard workstation to a jump server, their credentials are typed on or transmitted from the standard device. On a properly configured PAW, credentials are only ever typed on the PAW itself, which has no exposure to user-side threats. PAWs provide stronger isolation; jump servers are easier to deploy at scale.
How do I handle PAW access for cloud-only environments without on-premises AD?
For cloud-only environments (Entra ID only, no on-premises AD), a PAW equivalent is a dedicated, compliant, and hardened device with Entra ID join, Conditional Access policies that require device compliance for all admin portal access, and a separate Entra ID admin account (cloud-only, no on-premises sync) used exclusively from that device. Microsoft's Secure Access Workstation guidance covers the cloud-native PAW architecture in the Enterprise, Specialized, and Privileged tiers.
How often should PAW configurations be audited?
Quarterly at minimum. Audit checks should include: verify BitLocker is enabled and the recovery key is current, verify Credential Guard is active (msinfo32 > Virtualization-based security > Running), verify no internet-bound outbound connections are permitted from the PAW VLAN firewall, verify the PAW GPO has not been modified or had inheritance blocked, and verify that privileged admin logon events on target systems originate from PAW IP addresses and not standard user workstation IPs.
How do you prevent admins from using PAWs for general productivity tasks?
Technical controls are more reliable than policy. On the PAW, configure AppLocker or WDAC allowlisting to permit only approved administrative tools: PowerShell, the MMC snap-ins needed for your environment, remote management clients (RDCMan, Windows Admin Center), and PAM tooling. Block all browser access from the PAW or limit it to a specific allow-listed set of management portals. Remove or block the Microsoft Store, media players, and personal productivity apps. Configure the outbound firewall to permit connections only to your defined management network ranges and identity provider endpoints, blocking all general internet access from the PAW network segment.
How many PAWs do administrators need and what determines the tier assignment?
Assign one PAW per tier level that the administrator operates at, not one PAW per person. An administrator who manages both Tier 0 (domain controllers, Entra ID Global Admin) and Tier 1 (member servers) requires two PAWs: a Tier 0 PAW used only for Tier 0 management tasks and a Tier 1 PAW used only for Tier 1 tasks. The Tier 0 PAW must never be used to manage Tier 1 resources, as this introduces a path from Tier 1 compromise to Tier 0. In practice, most organizations start with a single elevated-use PAW for their most privileged administrators and expand the tiering model as their PAM program matures. Virtual PAWs (dedicated admin VMs on a hardened Hyper-V host) are an acceptable alternative to physical hardware when budget or logistics prevent distributing physical devices.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.