Skip to content
Get packs

AD Tiered Admin Model Auditor

Audits Active Directory privileged groups against the Tier 0/1/2 admin model and guides secure admin design.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent Microsoft's tiered administration model for Active Directory, which separates admin accounts so that a compromise of a low-level machine cannot easily lead to control of the whole domain. When installed, the agent can explain the Tier 0 (domain controllers and identity systems), Tier 1 (servers and applications) and Tier 2 (workstations and help desk) structure, advise on privileged access workstations and admin forest design, and run a bundled Python script that connects to an AD server via LDAP and lists members of privileged groups for review.

Great for

  • Identity or security engineers planning or hardening AD privileged-access architecture
  • Auditors or admins who want a first-pass list of who is in Domain Admins, Enterprise Admins and similar groups
  • Students learning how credential theft and lateral movement are contained in Windows environments

Skip it if

  • Production domains without authorization or a change process: the script queries directory data and should only be run with approval and ideally against a test or read-only account, since it is not an automated fix
  • Non-Windows or cloud-only identity setups (for example pure Entra ID) where the on-premises AD tier groups and LDAP queries do not apply
  • Organisations expecting a complete compliance assessment: the file is a general guide with generic NIST control mappings and the audit script covers only Tier 0 groups in the excerpt shown

Try asking

  • “Explain the ESAE tiered model and how Tier 0, 1 and 2 should be separated in our domain”
  • “Design a privileged access workstation setup for our Domain Admins”
  • “Review who is currently a member of Tier 0 groups in our AD using the audit script”
  • “Outline controls to reduce pass-the-hash and Kerberoasting risk in our forest”
Step-by-step guide: how to use AD Tiered Admin Model AuditorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    configuring-active-directory-tiered-model.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip configuring-active-directory-tiered-model.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip configuring-active-directory-tiered-model.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the audit script only in a lab or with an approved read-only account, and review its output before acting on it
  • Treat the NIST and MITRE mappings as starting points and validate them against your own compliance requirements
  • Ask the agent to explain each tier's boundaries before changing any group membership or policy

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.