Domain admins currently hold standing privileges all year. The county wants just-in-time elevation and short-lived credentials checked out of a vault. Which discipline delivers that model?

Standing Domain Admin membership all year maximizes the blast radius of phishing, malware, or insider misuse on county directories. Privileged access management (PAM) with just-in-time (JIT) permissions and ephemeral credentials checked out of a vault issues short-lived elevation only when needed, then expires it—reducing persistent god-mode and improving auditability of who elevated, when, and why. For municipal IT, PAM is the discipline that converts permanent privileged group membership into time-bounded, recorded admin power.

Shared break-glass passwords taped under keyboards create unaccountable standing secrets and invite physical and casual disclosure. Permanent Domain Admin for all IT interns institutionalizes over-privilege for the least experienced staff. Disabling audit logs on privileged sessions to 'reduce noise' removes the forensic trail that privileged operations require and is an anti-control.

Exam caveat: true break-glass accounts may still exist for emergencies, but they must be highly controlled, monitored, and rare—not taped under keyboards for daily use. JIT/PAM complements least privilege on day-to-day accounts; admins should work from non-privileged identities until elevation is checked out.

Operational check: remove standing Domain Admin from routine admin accounts, enroll elevation through the PAM vault with short TTLs, alert on privileged session start, and test that credentials expire and group membership reverts after the approved window.