A State Department review faulted Hillary Clinton for her exclusive use of a private email server during her tenure as secretary of state, saying the practice posed a security risk and did not comply with government records laws.
Revelations that Clinton used a personal email address and a server located in her home have raised questions about her tenure at the State Department and dogged her presidential campaign for months.
The State Department Office of Inspector General report, which leaked Wednesday, found Clinton had not sought permission for her unusual email arrangement and would likely have been denied had she sought permission. The report details warnings to Clinton aides about problems with the email arrangement that were ignored.
The report noted that Clinton was not alone in exclusively using a personal email account and that former secretary of state Colin Powell (2001-05) had done so as well. However it noted that security protocols were more advanced during Clinton's tenure.
Donald Trump, the presumptive Republican presidential nominee, mentioned the inspector general report in a broadside against Clinton at a campaign rally Wednesday in California.
"She's as crooked as they come," he said. "She had a little bad news today, as you know, from some reports [that] came down that weren't so good. Inspector general report - not good."
Republicans have long said the issues showed Clinton is untrustworthy and raised questions about her judgement.
"The inspector general's findings are just the latest chapter in the long saga of Hillary Clinton's bad judgement that broke federal rules and endangered our national security," Republican National Committee Chairman Reince Priebus said.
"The stakes are too high in this election to entrust the White House to someone with as much poor judgement and reckless disregard for the law as Hillary Clinton."
Clinton's campaign stressed that the report showed her actions were "not unique," that State Department officials knew she was using a private account, and that she took steps to preserve her records.
The report is due to be publicly released Thursday, but the Washington Post published a copy of it on its website Wednesday.
State Department spokesman Mark Toner would not comment on the specifics of the report before its official release, but said that the department has complied with all the recommendations handed down to improve security.
"The report does highlight the challenges that the State Department as well as other federal agencies are facing in trying to have proper record keeping and accountability in email communication," he said.
He stressed that there was no prohibition on using personal email, but the report describes an "obligation to use department systems in most circumstances."
The inspector general found "no evidence that the secretary requested or obtained guidance or approval to conduct official business via a personal email account or her private server," the report found.
The US State Department released thousands of Clinton's emails last year and earlier this year in order to comply with a judge's order in the face of lawsuits seeking their release under open records laws.
Clinton has said using the private server was "a mistake," as the email issue has become a liability in her presidential campaign. The affair has raised questions about transparency, technical security and her handling of sensitive email relating to the deadly 2012 attack on the US diplomatic compound in Benghazi, Libya.
The FBI is investigating Clinton's server to see if classified information was mishandled. In addition, several newspapers and other media outlets as well as Republicans in Congress want to examine the emails, as her years of service come under the microscope of a presidential race.
Clinton is the likely Democratic Party nominee for president, but still faces a primary challenge from Vermont Senator Bernie Sanders, who has vowed to remain in the race despite trailing Clinton in the number of delegates needed to secure the nomination.