Myrsini is performing a regularly scheduled review for service accounts. Which of the following events should she be most concerned about?

Interactive login for a service account is a critical warning sign, either of compromise or bad administrative practices. In either case, Myrsini should immediately work to determine why the account logged in, what occurred, and if the interactive login was done remotely or locally. A remote interactive login for a service account in any professionally maintained environment is an almost guaranteed sign of compromise. Password changes for service accounts may be done as part of ongoing password expiration processes, limitations should always be placed on service accounts rights to ensure that they are only those required, and a local use of the service account as part of the service is a normal event.