Question

How would you handle a security incident involving a compromised user account with possible credential theft?

Answer 1

You might:

• Immediately reset the compromised user's credentials.
• Disable the compromised account.
• Investigate the source of the credential theft.
• Scan other accounts for similar compromises.

Example code (PowerShell to reset a user password):

# Reset user password
Set-ADAccountPassword -Identity "CompromisedUser" -NewPassword (ConvertTo-SecureString -AsPlainText "NewSecurePassword" -Force)