A library Windows service account can RDP interactively and is also a local administrator on additional hosts. Which risk class should the finding emphasize?
Select an answer to reveal the explanation.
Short Explanation
A service account that can sit at the keyboard and also holds admin keys is like giving a vending-machine refill badge master keys to every closet. Once that identity is taken, the blast radius jumps.
Full Explanation
A library Windows service account that can RDP interactively and is also local administrator on additional hosts greatly expands compromise impact: service identities meant for non-interactive work become interactive lateral-movement and privilege pivots across the estate.
Service accounts are not safe by definition and often store credentials that can be recovered. RDP rights do not automatically block privilege escalation elsewhere. Interactive service accounts matter on member servers, not only domain controllers.
Exam caveat: separate 'log on as a service' from interactive RDP/local admin grants; least privilege means removing unnecessary interactive and admin rights.
Operational check: review service account rights (interactive logon, local admin group memberships), document blast radius across library hosts, and recommend dedicated locked-down identities without RDP or broad local admin. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.