Temporary Access

Mercur Retail LLP is a retail chain. The domain controller MER-DC-01 raised an alert: an account was added to a privileged group. Administrators do this regularly, so the alert alone settles nothing.

You need to work through the whole chain: when the account appeared, who created it, which group it was added to, and whether it was used afterwards. If it was used, the incident is no longer about permissions but about what was done.

The day's log also holds ordinary account operations — accounts are created for interns and contractors. Comparing against them is part of the task.