Identity with Windows Server 2016 — Question 189

Your network contains an Active Directory forest named contoso.com
Your company plans to hire 500 temporary employees for a project that will last 90 days.
You create a new user account for each employee. An organizational unit (OU) named Temp contains the user accounts for the employees.
You need to prevent the new users from accessing any of the resources in the domain after 90 days.
What should you do?

Answer options

• A. Run the Get-ADUser cmdlet and pipe the output to the Set-ADUser cmdlet.
• B. Create a group that contains all of the users in the Temp OU. Create a Password Setting object (PSO) for the new group.
• C. Create a Group Policy object (GPO) and link the GPO to the Temp OU. Modify the Password Policy settings of the GPO.
• D. Run the Get-ADOrganizationalUnit cmdlet and pipe the output to the Set-Date cmdlet.

Correct answer: A

Explanation

The correct answer is A because by using the Get-ADUser cmdlet to retrieve the users and piping them to Set-ADUser, you can configure the accounts to become inactive after 90 days. Options B and C do not directly address the requirement to deny access after a specific time period, and option D is irrelevant as it involves setting a date for an organizational unit rather than user accounts.