Loading the path…

Payroll files

svc-backup is also on the payroll share. Retiring the account closes this path with the directory path.

Open path

StartVY-WIN-0142
Credentialsvc-backup
WeaknessPayroll ACL
ImpactPayroll files

Fix that breaks this chain

Retire svc-backup

Remove the service account that can replicate the directory and read payroll. Domain Admin stays open through the breached password until that one is reset.

Proof on each hop

1. VY-WIN-0142
Same assumed breach as the directory path.
2. svc-backup
Recovered from ERP-SQL-01.
3. Payroll ACL
Directory listing succeeded. File bodies were not read.
```
share: \\FS-PAYROLL\payroll
principal: svc-backup
listing: 2026-Q3 payroll workbook [name only]
bytes read: 0 (proof stopped at the directory listing)
No prevention. No detection.
```
Fix. Remove svc-backup from the payroll ACL. The same identity change also stops directory replication.
Open weakness
4. Payroll files
FS-PAYROLL\payroll is readable by the backup account.

Found on PT-1842.

Loading the path…

Payroll files

Fix that breaks this chain

Proof on each hop

1. VY-WIN-0142

2. svc-backup

3. Payroll ACL

4. Payroll files

Payroll files

Fix that breaks this chain

Proof on each hop

1. VY-WIN-0142

2. svc-backup

3. Payroll ACL

4. Payroll files