Domain-controller privileged logons for the school-district directory have gone unreviewed for months. Which testing activity should the security manager add first?

Scheduled log reviews of privileged authentication events are an explicit Domain 6 control-testing activity. Domain-controller privileged logons for a school-district directory are high-value evidence of misuse, shared-account drift, or compromised admin credentials; leaving them unreviewed for months means detective controls exist on paper but are not exercised. Adding a cadence for examining privileged authentication events restores the testing and monitoring expectation: evidence is examined, anomalies are escalated, and control effectiveness is measured rather than assumed.

Immediately decommissioning all domain controllers to eliminate log volume destroys the identity plane the district depends on; it is not a testing activity and creates availability and safety failures far worse than unread logs. Replacing the directory with an unmonitored cloud share for staff photos abandons centralized authentication and monitoring for a worse control environment. Suspending all privileged accounts without an access-review process causes operational outage and still fails to implement the missing detective control—review of privileged events—while creating chaos for legitimate administration.

Exam caveat: When logs have gone unreviewed, the first corrective assessment activity is usually to institute review (or automate alerting plus review), not to remove the systems that generate the evidence. Domain 6 pairs technical testing with process testing such as log review.

Operational check: Define which privileged events matter (Domain Admin, Enterprise Admin, privileged group changes, unusual hours), set a review schedule with named reviewers and escalation paths, sample-test that reviews actually occur, and retain evidence of review completion for audit of the school district’s IAM detective controls.