A county engagement confirms local privilege escalation. Which evidence approach best matches least-impact professional proof?

After confirming local privilege escalation on a county host, least-impact professional proof favors controlled evidence: reading a protected file, showing an equivalent low-impact check, or capturing before/after identity with clear notes—not destructive demonstrations.

Reformatting the system drive is unacceptable. Permanently disabling security agents as the primary screenshot is harmful. Creating dozens of new domain admins for persistence theater exceeds proof needs and increases cleanup risk.

Exam caveat: agree on proof standards in RoE; prefer reversible, minimal artifacts on municipal systems.

Operational check: capture whoami/privilege evidence and a single protected-resource read, store screenshots with timestamps, and avoid persistence that complicates county cleanup. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.