A county gold image used for fleet builds embeds a domain-join credential in the template. What AD-adjacent risk should the assessment highlight?
Select an answer to reveal the explanation.
Short Explanation
Stuffing a join password into the master image is like printing the building code on every keycard blank. Every machine cloned from that gold image may inherit the same secret. That is AD hygiene risk sitting in the imaging pipeline.
Full Explanation
Imaging templates that embed domain-join or admin secrets can seed widespread credential exposure. A county gold image used for fleet builds that contains a join credential risks distributing that secret across every newly imaged workstation—creating durable AD-adjacent credential sprawl affecting the same identity plane that protects municipal endpoints.
Embedded join credentials are not limited to screen savers. Gold images absolutely interact with AD when they auto-join or carry domain secrets. Domain-join secrets in images are not a Kerberos protocol requirement that cannot be removed; modern join workflows can avoid baking long-lived secrets into templates.
Exam caveat: treat image/secret hygiene as part of AD attack-surface reduction alongside LAPS and tiering. CPTS findings may start from “where do join credentials live?” not only from LDAP ACLs.
Operational check: audit civic gold images and deployment pipelines for embedded domain secrets, rotate any exposed credentials, switch to safer join methods, and re-scan images before the next fleet refresh. Pipeline scanners should fail county image builds that embed domain secrets, preventing the next fleet wave from reintroducing the same credential sprawl.