A transit administrator uses the same password on a personal Domain Admin account and a daily workstation login. What hygiene lesson should the report emphasize?

Credential reuse across privilege tiers collapses the boundary between a daily workstation and Domain Admin. For a transit agency whose operators schedule routes and manage fare systems for riders, a personal Domain Admin password that matches a workstation login means phishing, malware, or local theft on the daily host can immediately yield directory-control secrets. Separate privileged accounts with unique passwords shrink that reuse path so compromise of lower-trust endpoints does not automatically hand over the keys to Active Directory.

MFA limited to email does not sanitize password reuse on the Domain Admin secret itself—those are different controls protecting different surfaces. Claiming uniqueness only for service accounts ignores interactive admin identities, which are equally attractive theft targets during civic operations. Sharing an OU does not authorize sharing passwords across privilege tiers; organizational placement is not an authentication control.

Exam caveat: tiered administration is about both account separation and secret uniqueness—having two account names with one shared password fails the model. CPTS-style AD judgments emphasize reducing credential-reuse paths, not checkbox MFA elsewhere.

Operational check: inventory Domain Admin and other Tier-0 identities, confirm none share passwords with daily workstations, enforce dedicated PAWs or hardened jump hosts for privileged work, and verify ticket notes document unique vaulted secrets. Re-test after a password-rotation window whether workstation dumps still unlock any privileged civic admin account.