A county assessment finds plaintext passwords in AD descriptions or scripts stored in SYSVOL. What finding class does this represent?
Select an answer to reveal the explanation.
Short Explanation
If the password is sitting in a share that half the domain can read, it is not a secret anymore — it is a flyer on a bulletin board. SYSVOL and script plaintext creds are a classic AD finding for a reason.
Full Explanation
Plaintext passwords in AD descriptions or scripts stored in SYSVOL during a county assessment represent classic SYSVOL or script secret exposure that can reveal credentials to any principal with read access. That is not an expected hardening control or proof passwords are “backed up correctly.” It is not a cosmetic documentation issue. SYSVOL readability for authenticated users is exactly why secrets there are dangerous—not evidence the location is safe. Exam caveat: secret-in-SYSVOL findings are high-yield and should use careful redaction in reports. Operational check: locate the script or attribute under authorization, prove readability without mass-distributing secrets, remove or vault the credentials, rotate exposed accounts, and scan SYSVOL for remaining password patterns. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments. Keep secret material and session artifacts in the approved vaulted workflow rather than chat paste or unprotected tickets used by mixed municipal teams.