Detailed Deployment Guide

This guide provides a step-by-step deployment workflow using scoped deployment parameters. Use this approach when you need granular control over the deployment process or want to deploy components incrementally.

For a streamlined full deployment workflow, see the Quick Deployment Guide.

Supported environment: English (en-US) only — the host OS (the machine you run the scripts from) and Active Directory must both be English. Non-English environments are detected and stopped during prerequisite validation. See Language Support.

Overview

This detailed approach deploys Tier Model components one type at a time, following the proper dependency order:

Organizational Units (OUs) - Foundation hierarchy
Security Groups - Required for ACL delegations and GPO filtering
User Accounts - Service accounts and administrative users
OU ACL Delegations - Permissions and rights delegation
Group Policy Objects (GPOs) - Policy configuration and linking
ADMX Templates - Administrative template imports

Each component follows a three-step pattern: 1. Plan - Preview changes without applying them 2. Deploy - Execute the deployment with -ConfirmApply 3. Audit - Verify compliance and detect drift

Step 1: Deploy Organizational Units

1.1 Plan OU Deployment

Review what OUs will be created:

.\Deploy-TierModel.ps1 -OuOnly -PreferredDc DC01.contoso.com

Expected Output: - List of OUs to be created - OU paths and protection settings - No changes applied to Active Directory

1.2 Deploy OUs

Execute the OU deployment:

.\Deploy-TierModel.ps1 -OuOnly -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - OUs created successfully - Protection from accidental deletion applied - Deployment summary

1.3 Audit OUs

Verify OU compliance:

.\Audit-TierModel.ps1 -OuOnly -PreferredDc DC01.contoso.com

Expected Output: - All OUs compliant - No drift detected - Zero high-severity findings

Step 2: Deploy Security Groups

2.1 Plan Group Deployment

Review what groups will be created:

.\Deploy-TierModel.ps1 -GroupOnly -PreferredDc DC01.contoso.com

Expected Output: - List of groups to be created - Group scope and type - Planned membership assignments - No changes applied to Active Directory

2.2 Deploy Groups

Execute the group deployment:

.\Deploy-TierModel.ps1 -GroupOnly -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - Groups created successfully - Group memberships configured - Deployment summary

2.3 Audit Groups

Verify group compliance:

.\Audit-TierModel.ps1 -GroupOnly -PreferredDc DC01.contoso.com

Expected Output: - All groups compliant - Membership matches configuration - No drift detected

Step 3: Deploy User Accounts

3.1 Plan User Deployment

Review what users will be created:

.\Deploy-TierModel.ps1 -UserOnly -PreferredDc DC01.contoso.com

Expected Output: - List of users to be created - User properties and group memberships - OU placement - No changes applied to Active Directory

3.2 Deploy Users

Execute the user deployment:

.\Deploy-TierModel.ps1 -UserOnly -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - Users created successfully - Group memberships assigned - Users placed in correct OUs - Deployment summary

3.3 Audit Users

Verify user compliance:

.\Audit-TierModel.ps1 -UserOnly -PreferredDc DC01.contoso.com

Expected Output: - All users compliant - Placement and membership correct - No drift detected

Step 4: Deploy OU ACL Delegations

4.1 Plan OU ACL Deployment

Review what ACL delegations will be applied:

.\Deploy-TierModel.ps1 -OuAclsOnly -PreferredDc DC01.contoso.com

Expected Output: - List of OUs receiving ACL delegations - Groups being delegated permissions - Rights and access control entries to be applied - No changes applied to Active Directory

4.2 Deploy OU ACLs

Execute the ACL delegation deployment:

.\Deploy-TierModel.ps1 -OuAclsOnly -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - ACL delegations applied successfully - Groups granted appropriate permissions - Deployment summary

4.3 Audit OU ACLs

Verify ACL delegation compliance:

.\Audit-TierModel.ps1 -OuAclsOnly -PreferredDc DC01.contoso.com

Expected Output: - All delegations compliant - Security principals have correct permissions - No drift detected

Step 5: Deploy Group Policy Objects

5.1 Plan GPO Deployment

Review what GPOs will be created and linked:

.\Deploy-TierModel.ps1 -GposOnly -PreferredDc DC01.contoso.com

Expected Output: - List of GPOs to be created or updated - GPO link targets and link order - Security filtering and WMI filters - No changes applied to Active Directory

5.2 Deploy GPOs

Execute the GPO deployment:

.\Deploy-TierModel.ps1 -GposOnly -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - GPOs created or updated successfully - GPOs linked to target OUs - Link order and enforcement configured - Deployment summary

5.3 Audit GPOs

Verify GPO compliance:

.\Audit-TierModel.ps1 -GposOnly -PreferredDc DC01.contoso.com

Expected Output: - All GPOs compliant - Links and settings match configuration - No drift detected

Step 6: Deploy ADMX Templates

6.1 Plan ADMX Deployment

Review what ADMX templates will be imported:

.\Deploy-TierModel.ps1 -AdmxOnly -PreferredDc DC01.contoso.com

Expected Output: - List of ADMX files to be imported to Central Store - ADML language files to be imported - Target path in SYSVOL - No changes applied to the domain

6.2 Deploy ADMX Templates

Execute the ADMX deployment:

.\Deploy-TierModel.ps1 -AdmxOnly -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - ADMX templates copied to Central Store - ADML language files deployed - Templates available for GPO configuration - Deployment summary

6.3 Audit ADMX Templates

Verify ADMX template compliance:

.\Audit-TierModel.ps1 -AdmxOnly -PreferredDc DC01.contoso.com

Expected Output: - All ADMX templates present in Central Store - File hashes match configuration - No drift detected

Step 7: Deploy MSA ACL Delegations (Optional)

This step is optional and only required if you need to manage Managed Service Account (MSA) permissions using the Tier Model. Enable with -IncludeMsa switch.

7.1 Plan MSA ACL Deployment

Review what MSA ACL delegations will be applied:

.\Deploy-TierModel.ps1 -IncludeMsa -PreferredDc DC01.contoso.com

Expected Output: - List of MSAs receiving ACL delegations - Groups being delegated permissions (msDS-ManagedServiceAccount object class) - Rights and access control entries to be applied - No changes applied to Active Directory

7.2 Deploy MSA ACLs

Execute the MSA ACL delegation deployment:

.\Deploy-TierModel.ps1 -IncludeMsa -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - MSA ACL delegations applied successfully - Groups granted appropriate permissions on MSA objects - Deployment summary

7.3 Audit MSA ACLs

Verify MSA ACL delegation compliance:

.\Audit-TierModel.ps1 -IncludeMsa -PreferredDc DC01.contoso.com

Expected Output: - All MSA delegations compliant - Security principals have correct permissions on msDS-ManagedServiceAccount objects - No drift detected

Step 8: Deploy gMSA ACL Delegations (Optional)

This step is optional and only required if you need to manage Group Managed Service Account (gMSA) permissions using the Tier Model. Enable with -IncludeGmsa switch.

8.1 Plan gMSA ACL Deployment

Review what gMSA ACL delegations will be applied:

.\Deploy-TierModel.ps1 -IncludeGmsa -PreferredDc DC01.contoso.com

Expected Output: - List of gMSAs receiving ACL delegations - Groups being delegated permissions (msDS-GroupManagedServiceAccount object class) - Rights and access control entries to be applied - No changes applied to Active Directory

8.2 Deploy gMSA ACLs

Execute the gMSA ACL delegation deployment:

.\Deploy-TierModel.ps1 -IncludeGmsa -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - gMSA ACL delegations applied successfully - Groups granted appropriate permissions on gMSA objects - Deployment summary

8.3 Audit gMSA ACLs

Verify gMSA ACL delegation compliance:

.\Audit-TierModel.ps1 -IncludeGmsa -PreferredDc DC01.contoso.com

Expected Output: - All gMSA delegations compliant - Security principals have correct permissions on msDS-GroupManagedServiceAccount objects - No drift detected

Step 9: Deploy dMSA ACL Delegations (Optional)

This step is optional and only required if you need to manage Delegated Managed Service Account (dMSA) permissions using the Tier Model. Enable with -IncludeDmsa switch.

9.1 Plan dMSA ACL Deployment

Review what dMSA ACL delegations will be applied:

.\Deploy-TierModel.ps1 -IncludeDmsa -PreferredDc DC01.contoso.com

Expected Output: - List of dMSAs receiving ACL delegations - Groups being delegated permissions (msDS-DelegatedManagedServiceAccount object class) - Rights and access control entries to be applied - No changes applied to Active Directory

9.2 Deploy dMSA ACLs

Execute the dMSA ACL delegation deployment:

.\Deploy-TierModel.ps1 -IncludeDmsa -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - dMSA ACL delegations applied successfully - Groups granted appropriate permissions on dMSA objects - Deployment summary

9.3 Audit dMSA ACLs

Verify dMSA ACL delegation compliance:

.\Audit-TierModel.ps1 -IncludeDmsa -PreferredDc DC01.contoso.com

Expected Output: - All dMSA delegations compliant - Security principals have correct permissions on msDS-DelegatedManagedServiceAccount objects - No drift detected

Step 10: Deploy Windows LAPS ACL Delegations (Optional)

This step is optional and only required if you use Windows LAPS encrypted-password storage. It deploys 7 ACL delegations (Self, Read, and Reset permissions per target OU) and sets the ADPasswordEncryptionPrincipal registry value on the 6 non-DC LAPS GPOs so the correct tier group can decrypt managed passwords. Enable with -IncludeWinLaps switch.

⚠️ Windows LAPS only — this feature exclusively uses the Windows LAPS APIs (ms-LAPS-* attributes). Legacy Microsoft LAPS (ms-Mcs-AdmPwd*, AdmPwd.PS) is never referenced or modified.

Prerequisites

Before running this step, the following must already exist in Active Directory:

Dependency	Required by
All Tier Model OUs	ACL delegation targets
All Tier Model Groups	Read/Reset permission principals
All 7 Windows LAPS GPOs	Decryptor configuration (GPO existence only, not links)
Windows LAPS schema extension (`ms-LAPS-Password` attribute class)	Schema gate — tool stops with a friendly error if absent; it never extends the schema itself

Missing OUs or groups produce a Dependency Errors listing and halt the plan. Missing GPOs are flagged per entry.

10.1 Plan Windows LAPS ACL Deployment

Review what delegations will be applied:

.\Deploy-TierModel.ps1 -IncludeWinLaps -PreferredDc DC01.contoso.com

Expected Output: - 7 target OUs listed with their read/reset group assignments - 6 ConfigureLapsDecryptor actions showing GPO name → decryptor principal - Domain Controllers OU shows Self + Read/Reset for Domain Admins (no decryptor — DSRM always uses Domain Admins) - No changes applied to Active Directory

10.2 Deploy Windows LAPS ACLs

Execute the Windows LAPS ACL deployment:

.\Deploy-TierModel.ps1 -IncludeWinLaps -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output: - 7 × Self-permission, Read-permission, Reset-permission delegations applied - 6 GPOs configured with ADPasswordEncryptionPrincipal (NETBIOS\sAMAccountName format) - Deployment is idempotent — re-runs skip already-configured delegations and decryptor entries - Deployment summary

10.3 Audit Windows LAPS ACLs

Verify Windows LAPS ACL and decryptor compliance:

.\Audit-TierModel.ps1 -IncludeWinLaps -PreferredDc DC01.contoso.com

Expected Output: - All 7 LAPS ACL delegations compliant (Self, Read, Reset present on each OU) - All 6 GPO decryptor values compliant (correct ADPasswordEncryptionPrincipal set) - No drift detected - Findings show Compliant for each delegation entry

Note on tier isolation: ADPasswordEncryptionPrincipal is a single principal per GPO. This means Tier 0 Admins can decrypt Tier 0 PAW passwords, but cannot decrypt Tier 1 or Tier 2 PAW passwords — each tier's admins decrypt only their own tier. This is intentional per-tier isolation enforced by CNG-DPAPI; GenericAll on a lower-tier PAW OU does not grant decryption.

Deploying Windows LAPS as Part of Full Deployment

-IncludeWinLaps composes cleanly with -FullDeployment. The Windows LAPS phase runs after MSA → gMSA → dMSA (Phase 10):

# Plan full deployment including Windows LAPS
.\Deploy-TierModel.ps1 -FullDeployment -IncludeWinLaps -PreferredDc DC01.contoso.com

# Apply full deployment including Windows LAPS
.\Deploy-TierModel.ps1 -FullDeployment -IncludeWinLaps -PreferredDc DC01.contoso.com -ConfirmApply

# Audit everything including Windows LAPS
.\Audit-TierModel.ps1 -FullDeployment -IncludeWinLaps -PreferredDc DC01.contoso.com

Opt-in: A plain -FullDeployment (without -IncludeWinLaps) does not deploy or audit Windows LAPS. You must explicitly add -IncludeWinLaps to include it.

Step 11: Configure Domain-Root Auditing (Optional)

This step configures domain-root object auditing for Microsoft Sentinel monitoring. It deploys a SACL (System Access Control List) audit rule on the domain root to generate the Security events that feed the Sentinel Tier Model solution. Enable with -EnableAuditing switch.

Sentinel monitoring prerequisite: This step addresses the SACL component of the two-part monitoring requirement. The DC Advanced Audit Policy GPO (*- Tier 0 DCs Advanced Audit Policy - Computer, linked by default) is the second piece — it enables event generation on each Domain Controller. Both the SACL and the GPO link must be in place for Sentinel to receive events. See Sentinel Monitoring — Before you begin for the full context.

Prerequisites

Before running this step, the following must already be in place:

Dependency	Reason
Tier Model deployed	The auditing configuration assumes Tier Model groups and OUs exist
SeSecurityPrivilege (Domain Admin)	Writing SACL audit rules requires the `SeSecurityPrivilege` privilege; Domain Admin holds this
Preferred DC binding	SACL reads and writes should bind to a single preferred DC; replication handles convergence (allow 15 minutes)

11.1 Plan Domain-Root Auditing

Review the audit SACL that will be applied to the domain root:

.\Deploy-TierModel.ps1 -EnableAuditing -PreferredDc DC01.contoso.com

Expected Output: - Phase 11: Domain Audit Rule (SACL) shown with action ■ Add audit rule on domain root - Audit rule details: Trustee Everyone (S-1-1-0), AuditFlags Success, InheritanceType All, Rights = 9 (Property Read, Property Write, Delete Child, List Child, Extended Right, Delete, Delete Tree, Change Owner, Change Permission) - No prompts, no changes applied to Active Directory - Deployment summary

11.2 Deploy Domain-Root Auditing

Execute the audit SACL deployment:

.\Deploy-TierModel.ps1 -EnableAuditing -PreferredDc DC01.contoso.com -ConfirmApply

Expected Output (Two-Y confirmation flow): 1. Auditing-specific confirmation prompt: "This will add/modify SACL audit rules on the domain root. Auditing increases Security event-log volume. Confirm? [Y/N]" — Type Y to accept auditing impact warning. 2. Standard deployment confirmation prompt: "Apply changes? [Y/N]" — Type Y to deploy the SACL audit rule. - SACL audit rule written to the domain root - Replication begins immediately; converges to all DCs within 15 minutes - Deployment summary

11.3 Audit Domain-Root Auditing

Verify audit SACL compliance:

.\Audit-TierModel.ps1 -EnableAuditing -PreferredDc DC01.contoso.com

Expected Output: - Phase 11: Domain Audit Rule (SACL) shown with per-right status - Each of the 9 target rights shown with ✅ (compliant) or ❌ (missing) - Audit rule details: existing ACE composition, status (Complete, Partial, or Absent) - No drift detected if all 9 rights are compliant - Audit summary

Composing -EnableAuditing with Full Deployment

-EnableAuditing composes cleanly with -FullDeployment:

# Plan full deployment including domain-root auditing
.\Deploy-TierModel.ps1 -FullDeployment -EnableAuditing -PreferredDc DC01.contoso.com

# Apply full deployment including domain-root auditing
.\Deploy-TierModel.ps1 -FullDeployment -EnableAuditing -PreferredDc DC01.contoso.com -ConfirmApply

# Audit everything including domain-root auditing
.\Audit-TierModel.ps1 -FullDeployment -EnableAuditing -PreferredDc DC01.contoso.com

Mutual exclusion: -EnableAuditing is mutually exclusive with other -*Only switches (OuOnly, GroupOnly, UserOnly, etc.). To deploy auditing alongside targeted component steps, use -FullDeployment -EnableAuditing instead.

Idempotency: The audit rule converges to the canonical state (all 9 rights present in a single SACL entry) and is fully idempotent. Re-running Deploy-TierModel.ps1 -EnableAuditing -ConfirmApply on an already-audited domain root skips the write and exits cleanly.

.\Audit-TierModel.ps1 -FullDeployment -PreferredDc DC01.contoso.com

Expected Output: - All components compliant across all categories - Zero high-severity findings - Complete audit report

Enable the Account Restrictions GPO (Before Go-Live)

Before you begin using the Tier Model in production, enable the domain-root *- Tier Model Account Restrictions GPO. It ships link-disabled by design and is the control that prevents built-in Tier Model groups and well-known Tier 0 groups from logging on to endpoints outside the Tier Model.

⚠️ Understand this GPO before enabling it. Once linked, it applies to all production endpoints outside the Tier Model — both client and server — but not domain controllers (Domain Controllers and RODCs are explicitly excluded from the GPO). Because it is linked at the domain root, you must evaluate any OU with Block Inheritance or an existing Enforced GPO so that it reaches every such endpoint at priority 1.

See GPO Management Guidance — Enable the Account Restrictions GPO First for the full explanation, including the block-inheritance and enforcement evaluation.

Troubleshooting

Component Dependencies

If a deployment step fails, verify dependencies are in place: - Groups require OUs to exist - Users require OUs and Groups to exist - OU ACLs require OUs and Groups to exist - MSA ACLs (Optional) require MSA objects and Groups to exist - gMSA ACLs (Optional) require gMSA objects and Groups to exist - dMSA ACLs (Optional) require dMSA objects and Groups to exist - Windows LAPS ACLs (Optional) require OUs, Groups, and all 7 Windows LAPS GPOs to exist; Windows LAPS schema extension (ms-LAPS-Password) must be present - GPOs require OUs to exist for linking

Redeployment

If issues occur, you can safely re-run any deployment step. The deployment scripts are idempotent and will skip existing objects:

# Re-run a specific component deployment
.\Deploy-TierModel.ps1 -GroupOnly -PreferredDc DC01.contoso.com -ConfirmApply

Audit Failures

If an audit step reports drift or non-compliance: 1. Review the audit findings 2. Identify the specific discrepancies 3. Re-run the deployment for that component to remediate 4. Re-audit to verify compliance

When to Use This Approach

Use this detailed step-by-step approach when: - Deploying to production for the first time - Validating each component before proceeding - Troubleshooting specific component issues - Learning the deployment process - Meeting change control requirements for incremental changes

For routine deployments or updates, consider using the Quick Deployment Guide with -FullDeployment.

Next Steps

After successful deployment: - Schedule regular audits to detect configuration drift - Document any manual changes made outside automation - Review audit reports periodically for compliance monitoring

For additional documentation, see: - Quick Deployment Guide - Deployment Methodology - Drift Detection Details - GPO Management Strategy

Appendix: Troubleshooting Diagnostic Output

Use the v2.1.0 diagnostic switches when a normal deployment or audit does not give enough information to understand what happened during a run. Start with verbose output for most operator questions. Use debug output only when verbose output is not enough, because debug mode is noticeably slower and much noisier by design.

Use -EnableVerbose and -EnableDebug on Deploy-TierModel.ps1 or Audit-TierModel.ps1. These names are deliberate: they raise the script preference variables while leaving PowerShell's common -Verbose and -Debug parameters available and unshadowed.

For the full logging reference, see Tier Model Logging.

Escalation ladder

Replace -GposOnly with the component switch you are troubleshooting. For a deployment plan, omit -ConfirmApply.

Normal run — use first when you expect the standard summary to be enough.

powershell .\Deploy-TierModel.ps1 -GposOnly -PreferredDc DC01.contoso.com -ConfirmApply .\Audit-TierModel.ps1 -GposOnly -PreferredDc DC01.contoso.com
Verbose run — use for most stalls, unexpected skips, or unclear audit output.

powershell .\Deploy-TierModel.ps1 -GposOnly -PreferredDc DC01.contoso.com -ConfirmApply -EnableVerbose .\Audit-TierModel.ps1 -GposOnly -PreferredDc DC01.contoso.com -EnableVerbose
Verbose + debug run — last rung. Use only when you need a deeper support artifact and accept the slower, noisier run.

powershell .\Deploy-TierModel.ps1 -GposOnly -PreferredDc DC01.contoso.com -ConfirmApply -EnableVerbose -EnableDebug .\Audit-TierModel.ps1 -GposOnly -PreferredDc DC01.contoso.com -EnableVerbose -EnableDebug

Where diagnostic output is written

Either diagnostic switch automatically enables -Logging; the script announces that logging was enabled for the diagnostic run. Diagnostic files are written under a Debug\ subfolder beside the script, separate from the normal log output.

A PowerShell transcript starts only when both -EnableVerbose and -EnableDebug are supplied together. A single diagnostic switch does not start a transcript. The transcript adds a console-level record of the run, including prompts, command output, warnings, verbose messages, and debug messages that crossed the console.

Deploy and Audit do not apply log retention to normal or diagnostic log files. Unlike optional\Update-TierModelMembership.ps1, which keeps 7 days for scheduled operation, Deploy and Audit are normally run once, interactively, to confirm a deployment or audit result. Collect or remove the diagnostic files when the investigation is complete.

🔴 WARNING — transcripts are unredacted.

A transcript captures whatever crossed the console. Review the transcript yourself before attaching it to a public GitHub issue, support case, email, or chat. Do not share it until you are satisfied it contains no sensitive tenant, domain, account, path, or operational data.

Symptom → what to try

Symptom	What to try
A deployment or audit phase appears to stall or sits on one phase longer than expected	Re-run that same scoped command with `-EnableVerbose` first. Verbose output usually shows the current phase, object, or validation step. Escalate to both switches only if the verbose run still leaves the stall unclear.
An expected OU, group, user, GPO, or delegation does not appear to have been created	Re-run the same deployment scope with `-EnableVerbose`, then audit the same scope with `-EnableVerbose`. Compare the standard summary with the `Debug\` output to confirm whether the item was planned, skipped, failed, or still awaiting a dependency.
An audit result looks wrong or does not match what you see in Active Directory or Group Policy Management	Re-run the audit with `-EnableVerbose` against the same `-PreferredDc`. If the mismatch remains and you need to provide evidence for review, run both switches together and review the transcript before sharing it.
The script says it enabled logging even though you did not pass `-Logging`	This is expected when either diagnostic switch is used. The diagnostic switch auto-enables logging and writes its diagnostic artifacts under `Debug\`.
Debug output is slow or extremely noisy	This is expected. `-EnableDebug` raises the debug preference and should be reserved for the final escalation rung, especially when combined with transcript capture.

What these switches will not tell you

These switches surface more diagnostic output; they are not a guaranteed root-cause tool. They do not prove why Active Directory or Group Policy accepted, rejected, delayed, or replicated a change. They also do not redact output, replace prerequisite validation, or guarantee that a missing object or unexpected audit result can be explained from a single run.