A library Windows service account can RDP interactively and is also a local administrator on additional hosts. Which risk class should the finding emphasize?

Service accounts intended for non-interactive workloads become high-value targets when they also allow interactive logon such as RDP and hold local administrator rights on multiple systems. That combination turns a single credential theft into rapid privilege escalation and lateral movement. Reports should recommend removing interactive logon, narrowing rights, and monitoring anomalous use. The finding is about identity design, not a specific exploit recipe.