Engineering Administration

A common anti-pattern in Active Directory administration is the idea of building out the production environment first and hardening the administration later. Almost every AD organization created before Server 2016 has been built this way. The complexity of abandoning legacy administrative identities and management processes and moving towards tiered permissions, restricted authentication, and Red Forests is one of the reasons the ESAE model (introduced well before that) did not get enough traction on the market and ended up being officially deprecated by Microsoft. On the other hand, Microsoft continues using ESAE in their internal infrastructure even at the time of writing, once again reconfirming the viability of the concept.