PAW overview
As part of the administrative separation between normal users and admin users (Segregation of Duties), a secure host, or "Privileged Access Workstation (PAW)", must exist to fully separate a standard computer from the specific privileged machine used for domain privileged maintenance. These assets are the main target of any attacker who is looking to compromise the directory, and this is why is so important to secure and protect such assets.
What is a Privileged Access Workstation (PAW)?
The PAW is a dedicated, hardened device used exclusively for sensitive tasks such as managing Active Directory, Azure AD, or other critical systems. It is isolated from the regular user environment and has strict access controls in place to prevent unauthorized access.
Each of the defined tiers or areas within this model (Admin/Tier0, Servers/Tier1 & Sites/Tier2) will have its own set of Privileged Access Workstation (PAW) for administration; is not permitted to share PAWs between Areas/Tiers. Those assets will be under control of Tier0 administrators. These assets will have a set of restrictions, used to protect the privileged access to the environment. For example, logon restrictions, web surfing or having local administrative privileges.
Using the same workstation for daily work and for administering the environment is not a good idea. By simply having a segregated workstation, we are effectively increasing the security. The following table can give us a rough estimation on how much can we increase the security of our environment.
Measure effort
The following table shows a rough estimation of the effort that can be applied to these assets, and the percentage of security increase that can be achieved by applying such measures.
| Action | Percent |
|---|---|
| Have a separated workstation exclusively for administration | 30% |
| Have latest OS on separated workstation | 20% |
| Hardening of the OS image | 10% |
| Secure boot & encrypt disk | 10% |
| Have a separate patching procedure for these assets | 10% |
| Software restrictions | 5% |
| Logon restrictions | 5% |
| Reduced attack surface | 5% |
Bear in mind that there is no absolute solution. What can be enough for some company might be insufficient for another.
Also, the security increase is not cumulative. For example, if we have a separated workstation exclusively for administration (30%), and we have the latest OS on that workstation (20%), we do not get a 50% increase in security. Instead, we only get the highest individual measure applied, which is 30% in this case.
These equipment's will have a hardened OS implementation and toolsets designed exclusively for secure administration tasks. The access to these equipment's will be restricted based on the delegated rights of the user and the Tiering definition. In other words, only users with privileged rights granted will be able to logon into these computers.
These assets will be managed and maintained by the infrastructure owners. We will achieve this by sub-dividing the objects into functional containers. This approach allows for more granular control and monitoring of privileged access activities.
Jerry Devore, a Microsoft Premier Field Engineer has a nice walkthrough of PAW concept.
Why Privileged Access Workstations (PAW) Are Essential in Any IT Environment
Microsoft “Privileged Access Devices” documentation.
In today's threat landscape, securing privileged access is non-negotiable. Whether your infrastructure is fully on-premises, hybrid, or entirely cloud-based, the need to isolate and protect privileged credentials remains constant. This is where Privileged Access Workstations (PAWs) play a critical role.
PAWs are specialized, hardened endpoints dedicated solely to administrative tasks. By segregating these activities from everyday user operations, PAWs significantly reduce the attack surface and mitigate risks associated with credential theft, lateral movement, and privilege escalation.
A PAW is a hardened and dedicated endpoint used exclusively for sensitive administrative tasks, such as managing Active Directory, Azure AD, or cloud workloads. It is deliberately segregated from everyday usage like web browsing, email, or office applications'common vectors for phishing, malware, and token theft.
On-Premises Environments
In classic on-prem infrastructures, especially those built around Active Directory, PAWs help protect Tier 0 assets such as domain controllers, schema masters, and enterprise admin roles. A single compromised workstation with cached admin credentials can cascade into a full domain compromise. Using PAWs, admins interact with privileged systems from a secure, locked-down context'minimizing lateral movement and pass-the-hash exposure.
Hybrid Environments
Hybrid IT adds complexity by bridging on-prem and cloud identities. Admins often manage both AD and Azure AD from the same device. Without PAWs, this overlap becomes a security liability. A compromised hybrid admin device could leak tokens or credentials to both realms. PAWs create a boundary that upholds Zero Trust principles by ensuring privileged access sessions are initiated from trusted, verifiable endpoints.
Cloud-Only Environments
Even in cloud-native infrastructures, privileged accounts remain prime targets. Azure AD, Microsoft 365, and cloud management portals like Azure Resource Manager (ARM) all grant access to high-impact controls. Compromising a cloud admin's device often leads directly to data exfiltration or service disruption. Cloud-based attacks like token replay, consent phishing, and session hijacking can be mitigated when administrators operate from PAWs that enforce endpoint compliance, multi-factor authentication, and hardened configurations.
Final Thoughts
Regardless of your infrastructure's location, privileged access is a risk multiplier and its exposure must be minimized. Implementing PAWs ensures that administrative access originates from secure, purpose-built devices that reduce attack surface and enforce operational discipline.
Security doesn't start in the cloud or on the domain'it starts at the keyboard. PAWs make that keyboard resilient.
The Cost of Not Implementing PAW
The most common objection to PAW deployment is operational overhead. The real cost, however, is the absence of PAWs. Every breach involving Active Directory or cloud admin accounts is traceable to a single failure point: an administrator authenticated from an endpoint that was not dedicated, hardened, or isolated. The table below maps four high-frequency attack patterns directly to the PAW control that neutralises each one.
Real Breach Cost Reference
According to the IBM Cost of a Data Breach Report (2024), the average cost of a breach involving compromised credentials is $4.81 million USD. Breaches originating from a stolen or abused privileged account consistently rank in the top three most expensive breach categories. PAW deployment typically costs 15-30 person-days of infrastructure work — a fixed one-time investment versus an unbounded incident cost.
Attack Vector to PAW Control Mapping
| Attack Vector | What Happens Without a PAW | PAW Control That Stops It | Attack Stage Blocked |
|---|---|---|---|
| Pass-the-Hash / Credential Theft | Admin uses the same laptop for email and AD management. A phishing email drops a credential harvester. The NT hash of a Domain Admin account is captured and replayed to authenticate directly to a Domain Controller without ever knowing the password. | PAW has no email client, no general web browser, and enforces Windows Defender Credential Guard. NT hashes are never extractable from LSASS on a properly hardened PAW. | Lateral Movement (TA0008) |
| Admin Workstation → Domain Compromise (Golden Ticket) | Attacker pivots from the admin's regular laptop to a Domain Controller using stolen
credentials. DCSync is executed to dump the krbtgt hash. A forged Golden
Ticket grants persistent, undetectable Domain Admin access for up to 10 years. |
PAW network isolation rules block all inbound and outbound connectivity except to explicitly whitelisted Tier 0 management ports. No path exists from a compromised regular workstation to the PAW's privilege plane. Admin logon to DCs requires origination from a PAW enforced by an Authentication Policy Silo. | Privilege Escalation (TA0004) |
| Unsigned / Supply-Chain Admin Tool | Admin downloads a "useful" community PowerShell module on their regular machine. The module contains a hidden payload that dumps LSASS memory on execution. Admin credentials and Kerberos tickets are exfiltrated within seconds of import. | WDAC (Windows Defender Application Control) and AppLocker on the PAW enforce allowlisting. Only signed, baseline-approved binaries and scripts execute. Any unsigned or unknown executable is blocked before it runs. | Execution (TA0002) |
| Cloud Token Theft / Session Hijacking | A Global Admin signs into the Azure Portal from their regular browser, which also has personal tabs open. A malicious browser extension or cross-site script steals the OAuth session token. The attacker replays the token from a different IP, bypassing MFA entirely, and escalates to full tenant ownership. | PAW enforces Entra ID Conditional Access device compliance — only PAW devices with a compliant hardware token are permitted to access Azure Portal and admin portals. Session tokens are non-transferable across device compliance contexts. No personal browser profiles or extensions permitted on PAW. | Initial Access / Credential Access (TA0001 / TA0006) |
| Ransomware Lateral Movement via Saved Credentials | Ransomware infects a server admin's laptop through a phishing document. It enumerates Windows Credential Manager and browser saved passwords, finds stored RDP credentials to multiple servers, and encrypts them systematically before any alert is triggered. | PAW outbound firewall rules permit only explicitly named management connections to authorised Tier assets. Credential Manager is locked via GPO. No browser password stores exist. Ransomware that lands on a PAW has no lateral movement path and cannot reach production servers. | Lateral Movement / Impact (TA0008 / TA0040) |
Compliance and Regulatory Exposure
Not deploying PAWs is increasingly a compliance failure, not just a security gap. The following frameworks explicitly call for privileged access isolation:
- NIST SP 800-171 / CMMC Level 2+ — Requires privileged accounts to be managed from dedicated systems with restricted access.
- CIS Controls v8 (Control 12) — Network infrastructure management must be performed from segmented, dedicated management workstations.
- ISO 27001:2022 (A.8.18) — Privileged access rights must use dedicated administration accounts and access paths.
- DISA STIG / DoD Zero Trust — PAW-equivalent hardened endpoints are mandatory for Tier I privileged access.
- NIS2 Directive (EU) — Article 21 — Requires measures for privileged access management as part of essential entity security obligations.
The Minimum Viable PAW
If a full PAW deployment is not immediately feasible, start with the three controls that deliver the largest risk reduction:
- Dedicated device — even a low-cost refurbished laptop used only for administration eliminates the dual-use risk that enables most credential theft scenarios.
- No email or browser — enforced via GPO and WDAC. Removes the two primary phishing delivery vectors.
- Authentication Policy Silo — restricts Domain Admin account logons to PAW-tagged devices only, blocking credential relay even if a non-PAW device is compromised.
See the PAW Deployment Guide for the full phased rollout approach, GPO baselines, and golden image build instructions.
Related Resources
- PAW Deployment Guide — Complete step-by-step enterprise deployment guide covering architecture, golden image builds, GPO hardening baselines, phased rollout, operations, and automation
- Enterprise Access Model (EAM) — Cloud-extended privilege management extending PAW controls to Azure and Microsoft 365
- EAM Reference Architecture — Detailed architecture showing how PAWs integrate with Entra ID and cloud identity
- Active Directory Tier Model — Tier-based administrative segregation with PAW placement and authentication policies