A security auditor needs to verify that the principle of least privilege is applied to a Linux server. Which audit activity is most appropriate?