Server administrators for a city’s identity directory currently share a standing admin password on a sticky note. Which privileged-account operations practice should replace that approach?

Privileged-account operations for a city’s identity directory must eliminate standing shared secrets and replace them with accountable, time-bound access. Check-out or just-in-time privileged sessions grant elevated rights only for a defined window, require MFA to reduce credential replay and phishing success, and use session recording or detailed logging so administrative actions on domain controllers and identity stores are attributable. That pattern supports least privilege, forensic investigation, and rapid revocation when staff change roles—essential for municipal directories that unlock nearly every other system.

Keeping a shared password while changing sticky-note color is theater; the secret remains shared, unrotated in practice, and unauditable. Disabling logging of admin sessions to “protect administrator privacy” removes the primary detective control against insider misuse and attacker abuse of stolen admin credentials. Granting every help-desk technician permanent domain-admin rights to reduce ticket time massively expands the blast radius of phishing and mistakes; help-desk tasks rarely require standing directory domination.

Exam caveat: privileged access management emphasizes vaulting, check-out/JIT, MFA, monitoring, and avoidance of shared accounts. Convenience and trust are not substitutes for control. Session recording is especially relevant on sensitive administrative paths.

Operational check: inventory standing shared admin passwords on civic directories, migrate to a PAM check-out workflow with MFA and session logs, alert on privileged group changes, and periodically certify that help-desk roles use delegated, non-DA permissions.