A public-lobby kiosk in city hall was joined to the domain as a Domain Admin account “so Windows updates keep working.” What redesign best applies least privilege?
Select an answer to reveal the explanation.
Short Explanation
A lobby kiosk with Domain Admin is a master key taped to the front door. Least privilege means the kiosk gets a skinny badge for public use, while patching happens through a separate, watched privileged channel.
Full Explanation
Least privilege requires each subject to hold only the rights needed for its function. Public kiosks should operate as constrained non-administrative principals; software updates and management should use dedicated privileged mechanisms with monitoring. Elevating the interactive kiosk identity expands blast radius if the endpoint is compromised.