Containment: Lock the Compromised Account

Threat intel says the 'webadmin' account is compromised and being used interactively. Contain it: lock the account so its password can no longer authenticate, buying time before a full reset.

usermod -L webadmin # or: passwd -l webadmin

Locking prepends a '!' to the password hash in /etc/shadow, disabling password login without deleting the account (you still want it for forensics). Grading checks that webadmin's shadow entry is locked. Don't lock or delete anyone else.