R01.08.01.02 · 任务小类

目录、身份与远程支持

Directory, identity & remote support

Manage users and groups in AD/Entra/Okta and resolve a user issue over a remote-support session.

20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。

典型应用: Active Directory · Entra admin · Okta · Remote Desktop
小类 GUI 需求标签: HY · 混合

数字员工关联

本项目的小类归属，不代表员工能力实证或已导入基准覆盖。验收与价值指标均为建议，未测量 ROI。

关联岗位

IT 与软件交付 · 分别对应服务工单、恢复的配置、身份记录、仓库修复、通过的 CI 和发布包。

对照全部数字员工工作流设计

任务提案 · 20

展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。

R01.08.01.02-T01 Onboard a new hire in Active Directory Users and Computers from an HR form

原始指令

Using ADUC on the lab domain controller (RDP session), create the user described in `C:\input\hr_form_0147.pdf` in OU `Staff/Finance`: names, sAMAccountName per the naming rule in the form, title, department, manager, office phone, groups `FIN-Users` and `VPN-Users`, initial password from the form, and 'User must change password at next logon'.

平台: win · Windows
应用: Active Directory Users and Computers · Remote Desktop
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G3 · 仅 GUI
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

Get-ADUser -Properties *: DN in OU=Finance,OU=Staff; 9 attributes equal the form; memberOf has both groups; pwdLastSet=0. Script-block logging and Sysmon on the DC detect AD cmdlets, dsadd, net user or ldifde, so the account must come from ADUC in the RDP session, not PowerShell (see control pair T16).

建议部分得分

20% account in right OU; 40% attributes (scaled); 20% groups; 20% password flags

R01.08.01.02-T02 Offboard a departing employee in AD without deleting the account

原始指令

Ticket HR-2291: `jmarsh` (synthetic) leaves today. In ADUC: disable the account, move it to OU `Disabled/2026`, remove all group memberships except Domain Users, set Description to `Offboarded HR-2291 2026-10-14`, and set msExchHideFromAddressLists to TRUE in Attribute Editor. Do not delete the account.

平台: win · Windows
应用: Active Directory Users and Computers · Remote Desktop
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 3 / 5

建议验证方式

Account exists, userAccountControl has ACCOUNTDISABLE; DN in OU=2026,OU=Disabled; memberOf empty (primary group Domain Users); description exact; msExchHideFromAddressLists TRUE; no other user modified (whenChanged diff on OU). Script-block logging and Sysmon on the DC detect AD cmdlets, dsmod/dsmove or ldifde; any such use voids the task.

建议部分得分

25% disabled; 20% moved; 25% groups stripped; 30% description and GAL hide

R01.08.01.02-T03 Create a fine-grained password policy for privileged accounts

原始指令

In Active Directory Administrative Center on the lab DC, create Password Settings Object `PSO-Admins` with precedence 10: minimum length 16, history 24, max age 60 days, lockout after 5 attempts for 30 minutes, complexity on, reversible encryption off. Apply it to group `Tier0-Admins`.

平台: win · Windows
应用: Active Directory Administrative Center · Remote Desktop
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

Get-ADFineGrainedPasswordPolicy PSO-Admins: Precedence 10, MinPasswordLength 16, PasswordHistoryCount 24, MaxPasswordAge 60.00:00:00, LockoutThreshold 5, LockoutDuration and ObservationWindow 00:30:00, ComplexityEnabled true; AppliesTo = Tier0-Admins; Get-ADUserResultantPasswordPolicy for a member returns it. Script-block logging detects AD cmdlets run outside ADAC (dsac.exe host) or ldifde, voiding the task.

建议部分得分

50% policy values; 30% applied to group; 20% resultant policy verified

R01.08.01.02-T04 Author a report-only Conditional Access policy for a finance group

原始指令

In the Microsoft Entra admin center of the test tenant, create Conditional Access policy `CA-Finance-MFA` in Report-only: users = group `Finance`, excluding break-glass account `bg-admin@lab.onmicrosoft.com`; target all cloud apps except app `Legacy-Timesheet`; grant access requiring MFA; sign-in frequency 12 hours.

平台: web · 任意系统（网页）
应用: Entra admin center
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Graph identity/conditionalAccess/policies: state enabledForReportingButNotEnforced; includeGroups Finance id; excludeUsers bg-admin id; includeApplications All with excludeApplications Legacy-Timesheet appId; builtInControls mfa; signInFrequency 12 hours.

建议部分得分

20% state report-only; 30% users/exclusion; 25% apps/exclusion; 25% grant+session

R01.08.01.02-T05 Automate group membership and app assignment with an Okta group rule

原始指令

In the Okta developer sandbox org, create group `Sales-All`, a group rule that adds users whose `department` equals `Sales` and `employeeType` is not `Contractor`, activate it, and assign the SAML app `CRM-Sandbox` to the group. Verify that seeded user `pat.lee@sandbox.test` lands in the group.

平台: web · 任意系统（网页）
应用: Okta
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Okta API /groups/rules: rule ACTIVE with expression matching department and employeeType logic; /groups/{id}/users contains pat.lee and excludes the seeded contractor in Sales; /apps/{CRM}/groups includes Sales-All.

建议部分得分

20% group; 40% rule expression correct and active; 20% app assigned; 20% membership verified

R01.08.01.02-T06 Fix a missing mapped drive over a locked-down RDP session

原始指令

User `kchen` (synthetic) says drive S: disappeared. Connect to their test PC through the provided Remote Desktop session (clipboard and drive redirection disabled). Re-map S: to `\\fs01\shared\Projects` so it persists across sign-ins and reconnect at logon, using the user's existing credentials. Leave other drives as they are.

平台: win · Windows
应用: Remote Desktop · File Explorer
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G3 · 仅 GUI
GUI 需求 · 普通权限: G3 · 仅 GUI
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

On the target PC, HKCU\Network\S RemotePath \\fs01\shared\Projects in kchen's hive; after forced sign-out/in, S: is accessible; other mapped drives unchanged. The PC is reachable only through the RDP framebuffer: WinRM, admin shares and clipboard/drive redirection are disabled.

建议部分得分

50% S: mapped correctly; 30% persistent after re-login; 20% other drives untouched

R01.08.01.02-T07 Resolve an Outlook profile issue through a Quick Assist screen share

原始指令

A simulated user on a test PC starts a Quick Assist session and shares their screen view-only. Request control (the scripted user accepts), then fix their classic Outlook so the shared mailbox `support@lab.test` appears in the folder pane and their signature `Sig-2026` applies to new messages. End the session when done.

平台: win · Windows
应用: Quick Assist · Outlook
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G3 · 仅 GUI
GUI 需求 · 普通权限: G3 · 仅 GUI
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: licensed · 授权专业软件 xdevice · 跨设备
提案难度: 4 / 5

建议验证方式

On the user PC: Outlook profile has the shared mailbox added (additional mailbox entry in profile registry); NewSignature = Sig-2026; Quick Assist session log shows a control request accepted and session ended. The user PC is reachable only through the Quick Assist stream (no RDP, WinRM or file shares).

建议部分得分

20% control obtained; 40% shared mailbox added; 30% signature default; 10% session ended

R01.08.01.02-T08 Fix a user's paused print queue over macOS Screen Sharing

原始指令

Through Screen Sharing to the remote test Mac of user `amora`, resolve 'nothing prints': the queue `Floor3-MFP` is paused and the default printer was switched to a PDF writer. Resume the queue, set `Floor3-MFP` as default, set its defaults to two-sided and grayscale, and print `~/Documents/test_page.pdf`.

平台: mac · macOS
应用: Screen Sharing · System Settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G3 · 仅 GUI
GUI 需求 · 普通权限: G3 · 仅 GUI
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

On the remote Mac: `lpstat -p Floor3-MFP` enabled/idle; `lpstat -d` Floor3-MFP; lpoptions sides=two-sided-long-edge and ColorModel Gray; the CUPS test backend received a job for test_page.pdf with those options. The Mac is reachable only through the Screen Sharing framebuffer: Remote Login (SSH), ARD scripting and clipboard sync are disabled.

建议部分得分

30% queue resumed; 25% default; 25% duplex+gray; 20% job received

R01.08.01.02-T09 Find a lockout source in DC logs, then unlock and reset the account

原始指令

User `rpatel` (synthetic) is locked out repeatedly. On the lab DC, use Event Viewer's Security log to find the computer generating the 4740 lockouts, write it to `C:\triage\lockout_source.txt`, then in ADUC unlock the account and reset the password to the value in the ticket with 'must change at next logon'.

平台: win · Windows
应用: Event Viewer · Active Directory Users and Computers
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

lockout_source.txt equals the seeded Caller Computer Name (one of 3 lockout events for the user, decoy events for others); account lockoutTime 0; pwdLastSet 0 and password equals ticket (test bind succeeds then requires change). Script-block logging and Sysmon on the DC detect wevtutil, Get-WinEvent, Unlock-ADAccount, Set-ADAccountPassword or net user; any such use voids that milestone.

建议部分得分

40% lockout source; 30% unlocked; 30% password reset with flag

R01.08.01.02-T10 Delegate password resets on one OU to a helpdesk group

原始指令

Using the Delegation of Control Wizard in ADUC, give group `Helpdesk-T1` the ability to reset passwords and force password change at next logon for user objects in OU `Students` only. Do not grant full control or rights on other object types.

平台: win · Windows
应用: Active Directory Users and Computers
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

`dsacls OU=Students,...` shows Helpdesk-T1 ACEs: Reset Password extended right and write pwdLastSet, inherited to descendant user objects only; no other new ACEs on this or other OUs; a Helpdesk-T1 test account can reset a student password but not a staff one. Sysmon and script-block logging detect dsacls grants, Set-Acl on AD: paths or ADSI ACL edits by the agent; such runs fail.

建议部分得分

40% reset password right; 30% pwdLastSet write; 30% scope limited (no extra ACEs)

R01.08.01.02-T11 Revoke access for a departing user in Entra and Microsoft 365 admin

原始指令

For synthetic user `dlopez@lab.onmicrosoft.com` in the test tenant: revoke all sign-in sessions, block sign-in, remove all licenses, convert their mailbox to a shared mailbox, and give `manager1@lab.onmicrosoft.com` Full Access to it. Stop before deleting the user.

平台: web · 任意系统（网页）
应用: Entra admin center · Microsoft 365 admin center
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆 multiapp · 多应用
提案难度: 4 / 5

建议验证方式

Graph user accountEnabled false, signInSessionsValidFromDateTime after task start, assignedLicenses empty; Exchange Get-Mailbox RecipientTypeDetails SharedMailbox; Get-MailboxPermission shows manager1 FullAccess; user not deleted.

建议部分得分

40% sessions revoked and sign-in blocked; 20% licenses removed; 25% shared mailbox; 15% delegation

R01.08.01.02-T12 Diagnose a denied Okta sign-in from the System Log and fix the zone

原始指令

Sandbox user `mgreen@sandbox.test` cannot sign in from the branch office. Use the Okta System Log to find which policy and rule denied the sign-in, record them in `answer.json` (keys `policy`, `rule`, `reason`), then add the branch office CIDR shown in the denied event to network zone `Corp-Offices` so the sign-in policy allows it.

平台: web · 任意系统（网页）
应用: Okta
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

answer.json policy/rule names equal the seeded denying rule; reason mentions network zone; /zones Corp-Offices gateways include the exact CIDR and no broader range; a scripted sign-in from that IP now succeeds; other zones unchanged.

建议部分得分

40% correct policy/rule; 20% reason; 40% zone fixed precisely

R01.08.01.02-T13 Repair an app setting through a published app on a remote session host

原始指令

The legacy claims app is only reachable as a published RemoteApp from the lab RD Web portal (no desktop, no file access). Sign in with the test account, open the app, and in its Tools > Options dialog set the server to `claims-db02`, timeout to 60 s and default printer mapping off; then process the queued test claim CL-0042.

平台: win · Windows web · 任意系统（网页）
应用: Remote Desktop · RD Web Access
交互表面: desk · 桌面 GUI brow · 浏览器
GUI 需求 · 任务设定: G3 · 仅 GUI
GUI 需求 · 普通权限: G3 · 仅 GUI
交互原语: click · 指向与点击 type · 文字与表单 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Session host app settings (per-user config in the host profile) show server claims-db02, timeout 60, printer mapping off; claims DB row CL-0042 status Processed by the test user. The host is reachable only through the RemoteApp window (no full desktop, drive redirection or WinRM).

建议部分得分

20% app launched; 50% three settings (scaled); 30% claim processed

R01.08.01.02-T14 Audit nested membership of a VPN group and remove a stale nested group

原始指令

Using ADUC (Members/Member Of tabs), determine every user who effectively belongs to `VPN-Users` through any level of nesting and write their sAMAccountNames, sorted, one per line, to `C:\triage\vpn_effective.txt`. Then remove the nested group `Contractors-Old` from `VPN-Users`.

平台: win · Windows
应用: Active Directory Users and Computers
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 type · 文字与表单
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

File equals the effective member set computed at setup (3 nesting levels, a cycle, and disabled users included as members); after removal, Contractors-Old not in VPN-Users member; no other membership changed. Script-block logging and Sysmon on the DC detect Get-ADGroupMember, dsget or LDAP query tools, which void the list milestone.

建议部分得分

60% effective list (F1-scaled); 30% stale group removed; 10% no collateral changes

R01.08.01.02-T15 Set up a time-bound eligible admin role with Entra PIM

原始指令

In the test tenant's Entra admin center, make `ops1@lab.onmicrosoft.com` eligible (not active) for the User Administrator role for 6 months. Configure the role's PIM settings: max activation 4 hours, require MFA and justification on activation, require approval by `secops-approvers`, and notify `secops@lab.test` on activation.

平台: web · 任意系统（网页）
应用: Entra admin center
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Graph roleEligibilitySchedules: principal ops1, roleDefinition User Administrator, end ~6 months; no active assignment. unifiedRoleManagementPolicy rules: Expiration_EndUser_Assignment PT4H; Enablement MultiFactorAuthentication+Justification; Approval with secops-approvers; Notification recipient.

建议部分得分

30% eligible assignment; 25% activation duration; 25% MFA+justification+approval; 20% notification

R01.08.01.02-T16 Control pair of T01: onboard the same hire with PowerShell

原始指令

Control pair of T01. Onboard the user from `C:\input\hr_form_0147.pdf` (same attributes, OU, groups and password flags) using the ActiveDirectory PowerShell module only, from a WinRM session to the DC.

平台: win · Windows
应用: PowerShell · ActiveDirectory module
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

Same attribute checks as T01; creation event shows powershell/wsmprovhost as the process.

建议部分得分

20% OU; 40% attributes; 20% groups; 20% flags

R01.08.01.02-T17 Restore meeting audio for a remote Mac user over Screen Sharing

原始指令

User `lwong` (synthetic) on a remote test Mac says nobody hears them in the sandbox meeting app `MeetLite`. Over Screen Sharing: set input to the `USB Headset` device at 70% input volume, grant MeetLite microphone access in Privacy & Security, and run MeetLite's mic test until it shows 'Mic OK'.

平台: mac · macOS
应用: Screen Sharing · System Settings · MeetLite
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G3 · 仅 GUI
GUI 需求 · 普通权限: G3 · 仅 GUI
交互原语: click · 指向与点击 drag · 拖放 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Remote Mac: default input device UID = virtual USB Headset; input volume 0.65-0.75; TCC.db kTCCServiceMicrophone auth_value 2 for MeetLite bundle; MeetLite test log 'Mic OK' after the changes. TCC grant is user-only via the GUI on an unmanaged Mac.

建议部分得分

30% input device; 20% volume; 30% mic permission; 20% app test passes

R01.08.01.02-T18 Configure a SAML app integration in Okta for a sandbox service provider

原始指令

In the Okta sandbox org, create SAML 2.0 app `Wiki-Sandbox` using the SP metadata in `input/sp_metadata.xml` (ACS URL, entity ID), NameID format EmailAddress, attribute statements `firstName`, `lastName`, `groups` (filter: starts with `wiki-`), assign group `wiki-editors`, and confirm a test user can log into the SP.

平台: web · 任意系统（网页）
应用: Okta
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Okta API app settings.signOn: ssoAcsUrl and audience equal metadata; subjectNameIdFormat email; attributeStatements names and group filter regex/startsWith wiki-; group assigned; SP log shows a successful assertion for the test user with groups containing only wiki-* values.

建议部分得分

30% ACS/entity; 30% attributes incl. group filter; 20% assignment; 20% test SSO succeeds

R01.08.01.02-T19 Close a multi-cause helpdesk ticket across AD, a file share and an RDP session

原始指令

Ticket HD-7781: synthetic user `bnoor` cannot sign in, and once in, cannot open `\\fs01\finance` and Outlook starts with a temporary profile. Causes are seeded across AD (locked, expired password), group membership, and a corrupted local profile on their PC. Fix all of them using ADUC and an RDP session to the PC; summarise actions in `C:\triage\HD-7781.md`.

平台: win · Windows
应用: Active Directory Users and Computers · Remote Desktop · Computer Management
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G3 · 仅 GUI
GUI 需求 · 普通权限: G3 · 仅 GUI
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: long · 长流程 multiapp · 多应用 hidden · 隐藏 / 过期状态
提案难度: 5 / 5

建议验证方式

Account unlocked, password reset per ticket; member of FIN-Share-RW; on the PC, ProfileList has no .bak duplicate and the user loads a permanent profile with old Documents restored (hash match); share opens as bnoor; report lists the 4 causes. The PC is reachable only via the RDP session (no WinRM/admin shares), and DC script-block logging detects AD cmdlets or net user, voiding the account milestone.

建议部分得分

20% account fixed; 20% group; 40% profile repaired with data kept; 20% report

R01.08.01.02-T20 Respond to a risky sign-in for a test user in Entra ID Protection

原始指令

Entra ID Protection flags sign-ins for synthetic user `tkim@lab.onmicrosoft.com`. Review the sign-in logs, identify the sign-in from an atypical location (record its request ID, country and IP in `answer.json`), confirm the user compromised, revoke sessions, and require a password reset at next sign-in. Do not delete the user.

平台: web · 任意系统（网页）
应用: Entra admin center
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 5 / 5

建议验证方式

answer.json matches the seeded risky sign-in among 30 benign sign-ins; Graph riskyUsers tkim riskState confirmedCompromised; signInSessionsValidFromDateTime after task start; passwordProfile forceChangePasswordNextSignIn true; user still exists.

建议部分得分

40% correct sign-in identified; 20% confirmed compromised; 20% sessions revoked; 20% reset required

已有研究映射

当前映射未给此小类指定基准参考。

同工作流族的小类

R01.08.01.01 设备策略与配置描述文件