How to Define Tier-Zero Assets in Active Directory Security
There are plenty of AD objects and groups that should be considered tier zero in every environment, but some will vary among organizations.
Microsoft System Center Configuration Microsoft Enhanced Security Administration Environment Active Directory Enhanced Security Administration Environment Enterprise Access Model Domain Control
Source: darkreading.com