When I planned the transition to the Active Directory tier model, I looked at the Microsoft documentation and thought, "This will be done in three months, then life will return to normal." It took eight months. Three fundamental assumptions of mine were proven wrong, each costing me dearly in the field.

This post explains what someone transitioning to the T0/T1/T2 separation actually encountered, with the benefit of hindsight. I'll share the plan's breaking points, not the technical steps.

Tier boundaries are the theoretical minimum of cleanliness; the practical maximum of discipline.

A Quick Recap: What the Tier Model Separates

The tier model (a simplified version of Microsoft's Enhanced Security Admin Environment / ESAE) defines three layers:

T0 : Domain controllers, ADFS, PKI, ESAE forest, T0 admin accounts

T1 : Servers (application, database, file, monitoring), T1 admin accounts

T2 : Workstations, end-user accounts

The rule appears very simple: credentials from one tier can descend to a lower…