Guide · Agent skill
How to use the AD Tiered Admin Model Auditor agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The AD Tiered Admin Model Auditor is an agent skill, a packaged set of instructions and scripts that an AI agent such as Claude can load when a task matches it. This one covers Microsoft's Enhanced Security Admin Environment (ESAE) tiered model for Active Directory, which separates admin accounts so a compromise on a low-level machine does not easily become control of the whole domain. This guide shows you how to install it, how to phrase requests so the agent uses it, and what it needs and does when it runs a script.
AD Tiered Admin Model Auditormukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project folder.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings, then Capabilities, then Skills, and upload the ZIP.
- 4Install ldap3. Run pip install ldap3 with Python 3.8 or later installed.
- 5Ask a natural question. Describe your task in plain words that mention Active Directory, tiers or privileged groups.
- 6Confirm authorization. Check you have approval and a test or read-only account before any LDAP query.
- 7Review the output. Have a person check the group membership list the script returns.
What the skill makes the agent do
Once installed, the agent can explain the three-tier structure of the model. Tier 0 covers domain controllers and identity systems, Tier 1 covers servers and applications, and Tier 2 covers workstations and help desk. The skill also lets the agent advise on privileged access workstations (PAWs) and administrative forest design.
The skill includes a bundled Python script, scripts/agent.py, that connects to an Active Directory server over LDAP and lists members of privileged groups so a person can review them. The reference file lists Domain Admins and Enterprise Admins among the Tier 0 groups. The script is a first-pass review aid, not an automated fix: it reads directory data and does not change it.
- Explains Tier 0, Tier 1 and Tier 2 separation
- Advises on privileged access workstations and admin forest design
- Runs scripts/agent.py to list members of privileged groups for review
Install the skill on Claude or in a project
Download the ZIP file for the skill from this page. Then choose one of two routes.
For a personal setup, unzip the file into ~/.claude/skills/. To limit the skill to one project, unzip it into the .claude/skills/ folder inside that project instead.
If you use the Claude apps, you can instead upload the ZIP under Settings, then Capabilities, then Skills.
- Personal: unzip into ~/.claude/skills/
- Single project: unzip into .claude/skills/ in the project folder
- Claude apps: Settings, then Capabilities, then Skills, then upload the ZIP
Install the Python requirements for the script
The bundled script needs Python 3.8 or later and the ldap3 library. Install ldap3 with pip before you try to run scripts/agent.py.
The reference file also lists pyad for Windows AD object manipulation. The script's requirements list names only ldap3, so you do not need pyad for the group listing described here.
- Python 3.8 or later
- ldap3 Python library
pip install ldap3Ask for it in natural language
You do not need a special command to trigger the skill. Describe the task in plain words that mention Active Directory, tiers or privileged groups, and the agent should match the request to the skill. The skill's description covers designing or hardening privileged-access architecture, separating Domain and Enterprise Admin accounts into tiers, and containing lateral movement and credential theft.
Name the environment and the purpose so the agent knows whether you want a design explanation or a review of current group membership. Make clear that you have authorization to query the directory.
- Design question: How should we split our admin accounts into Tier 0, 1 and 2?
- Architecture question: Do we need privileged access workstations for domain admins, and how would an admin forest fit?
- Review request: List the current members of Domain Admins and Enterprise Admins from our test domain for a first-pass review.
Run a privileged group review safely
Before the script touches a domain, confirm three things: you have approval and a change process, the target is a test or lab domain or you are using a read-only account, and the account has authorization to query group membership. The script needs network access to a domain controller over LDAP and read-level credentials, and the reference describes an NTLM-authenticated bind.
Treat the output as a list for a human to check. The excerpt of the skill shows the audit covering Tier 0 groups only, so it is not a complete compliance assessment. The SKILL.md itself lists generic NIST 800-53 controls, such as AC-2, AC-6 and IA-2, which are a starting point rather than a finished audit.
- Get approval and follow your change process first
- Prefer a test environment or a read-only account
- Expect Tier 0 group coverage only in the excerpt shown
- Use the output as input to human review, not as an automatic fix
What people use it for
- Sketching how to split Domain Admin and server admin accounts into Tier 0, Tier 1 and Tier 2
- Preparing a first-pass list of who is in Domain Admins and Enterprise Admins for a review meeting
- Explaining to students how credential theft and lateral movement are contained by tiering
- Discussing whether privileged access workstations and an admin forest fit your environment
Frequently asked questions
How do I install the AD Tiered Admin Model Auditor skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. In the Claude apps, you can instead upload the ZIP under Settings, then Capabilities, then Skills.
What does the skill need to run?
The bundled script needs Python 3.8 or later, the ldap3 library installed with pip, network access to an Active Directory domain controller over LDAP, and read-level AD credentials with authorization to query group membership.
Is the skill free to use?
The skill is licensed under Apache-2.0, as stated on this page. Check the license file in the ZIP for the full terms before you redistribute it.
Does the script change my Active Directory?
No. The script queries directory data and lists privileged group members for review. It is not an automated fix, so it does not remove or change accounts.
Why does the script fail to connect?
The script needs network access to a domain controller over LDAP and valid read-level credentials. Check that the machine can reach the controller and that the account is authorized to query group membership. Run it against a test domain first.
Can this replace a full compliance audit?
No. The skill is a general guide with generic NIST 800-53 control mappings, and the audit script covers only the Tier 0 groups shown in the excerpt. Use it as a first-pass aid and pair it with your organisation's formal assessment process.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits identity and security engineers planning privileged-access tiers, auditors wanting a first-pass list of privileged group members, and students learning how lateral movement is contained. It is a poor fit for production domains without authorization, for cloud-only identity such as pure Entra ID, or for anyone needing a complete compliance assessment.
Download the skill