Backup User

Bereke Finance MFO is a microfinance company. The domain controller BER-DC-01 raised an alert: an account was added to a privileged group. Administrators do this regularly, so the alert alone settles nothing.

You need to work through the whole chain: when the account appeared, who created it, which group it was added to, and whether it was used afterwards. If it was used, the incident is no longer about permissions but about what was done.

The day's log also holds ordinary account operations — accounts are created for interns and contractors. Comparing against them is part of the task.