You should always start this process with the highest-risk systems. These typically include things such as active directory, core processors, wire transfers, and more. Overall, every system you have for which there is privileged access will usually be a higher-risk system.
