I dunno about that; it sounds like a PC in your sales department could connect to the RDP port on the AD, and the listed controls would have prevented that (RDP

I dunno about that; it sounds like a PC in your sales department could connect to the RDP port on the AD, and the listed controls would have prevented that (RDP port on the DC should be firewalled down to the machines administrators use to connect to them, which per the comment should _not_ include access to emails, just in case the compromise you're describing was actually an email from sales -> system administrator).