A review finds that system administrators read email, browse the web, and open documents while signed in with their domain administrator accounts. Which change BEST applies least privilege to reduce the impact if one of these activities leads to a compromise?

Least privilege requires that every activity run with the minimum rights it needs. When administrators read email or browse the web with domain administrator accounts, any malicious attachment, drive-by download, or phishing payload executes with domain-wide privileges, turning a routine infection into a full domain compromise. Separate least-privilege access accounts solve this: administrators use a standard account for everyday work and a distinct privileged account only when performing administrative tasks. Requiring MFA on the privileged accounts strengthens authentication, but once the administrator is signed in, malicious code running in that session inherits the session's privileges, so the exposure from daily activity remains. A web filter reduces the chance of reaching malicious sites, yet it does not cover email attachments or documents and still leaves any successful compromise running with administrative rights. Longer passwords and periodic rotation address credential guessing and reuse, not the impact of code executing in a privileged context. Exam caveat: separate admin accounts are most effective when combined with restrictions that prevent privileged accounts from receiving email or browsing the internet at all. Operational check: create standard accounts for each administrator, remove mailboxes and internet access from privileged accounts, and monitor privileged account sign-ins for interactive use on ordinary workstations.