After a domain migration, a civic directory still shows SID History and related leftover privilege artifacts granting unexpected access. How should the tester treat that?
Select an answer to reveal the explanation.
Short Explanation
Old badges left in wallets after a building move still open doors. SID History and migration leftovers can carry forgotten privileges into the new directory. Sweep those artifacts; do not assume the move cleaned every right.
Full Explanation
Directory migration leftovers such as SID History and related privilege artifacts can grant unintended rights after a domain migration. A civic directory that still shows unexpected access via those artifacts should treat them as review targets: users or groups may retain historical SIDs that authorize access beyond current role design, undermining least privilege for municipal applications and file systems.
Migration leftovers are not harmless metadata when they affect authorization decisions. SID History is an AD authorization concern, not merely Linux UID mapping. Unexpected privileges from artifacts do not by themselves prove a forest trust was never established—they prove residual access that needs cleanup.
Exam caveat: include SID History and migration ACL/group leftovers in post-migration AD hardening reviews. CPTS path analysis may show access that “should not exist” under the new OU model because of historical SIDs.
Operational check: inventory principals with SID History, evaluate whether each historical SID is still required, remove or block unintended paths per municipal AD cleanup standards, and re-test access to sensitive civic resources afterward. Post-migration AD cleanup is a public-service reliability task: unexpected rights confuse audits and enlarge insider and outsider paths alike.