A civic application service runs as Domain Admin without a strong justification. What recommendation aligns with AD least privilege?
Select an answer to reveal the explanation.
Short Explanation
A service that needs to print tickets does not need the keys to city hall. Domain Admin for ordinary app services is privilege theater gone wrong. Dial it down to what the job actually requires.
Full Explanation
Service identities should follow least privilege: only the rights needed for the application to operate. Unnecessary Domain Admin membership greatly increases blast radius if the service or its host is compromised. Disabling passwords or spreading Domain Admin further worsens hygiene rather than fixing it. Recommend dedicated, constrained service accounts instead.