Windows Server running Active Directory Certificate Services (AD CS) must be managed by a PAW tier 0.

Configure and set aside one or more PAWs for configuration and management of AD CS. 

For AD, multiple configuration items could enable anonymous access.

Set aside one or more PAWs for remote management of high-value IT resources assigned to a specific tier. For example, using the Microsoft Tier 0-2 model, each PAW would be assigned to manage Tier 0, Tier 1, or Tier 2 high-value IT resources.