Help desk technicians were added to the Domain Admins group so they could reset user passwords. A security review flags the practice. Which change BEST applies the principle of least privilege?

Least privilege grants each identity only the permissions required to perform its job. Resetting passwords is a narrow task, while Domain Admins membership confers control over every object, policy, and domain controller. Delegating the specific reset-password permission on the organizational units that contain user accounts gives technicians what they need, and removing them from Domain Admins eliminates the excess rights an attacker could abuse after phishing a help desk account. Adding MFA strengthens authentication, but once signed in, each technician still holds full domain control, so the exposure is reduced only at the login step. Weekly auditing is a detective control that may reveal misuse after it happens; it does not reduce the rights available to a compromised account. Consolidating into a shared admin account worsens the situation by removing individual accountability while keeping broad privileges. Exam caveat: when a stem asks for least privilege, the answer narrows permissions to the task; controls that verify identity or monitor activity are valuable but answer a different question. Operational check: list current members of privileged groups, confirm that help desk accounts hold only delegated reset and unlock rights on the intended OUs, and test that a technician account cannot modify group policy or privileged groups.