Plant Operator

Stepnoy Metall LLP is a metalworking plant. The domain controller STE-DC-01 raised an alert: an account was added to a privileged group. Administrators do this regularly, so the alert alone settles nothing.

You need to work through the whole chain: when the account appeared, who created it, which group it was added to, and whether it was used afterwards. If it was used, the incident is no longer about permissions but about what was done.

The day's log also holds ordinary account operations — accounts are created for interns and contractors. Comparing against them is part of the task.