Identity with Windows Server 2016 — Question 52

Your network contains an Active Directory domain named contoso.com.
You create a domain security group named Group1 and add several users to it.
You need to force all of the users in Group1 to change their password every 35 days. The solution must affect the Group1 users only.
What should you do?

Answer options

• A. Create a forms authentication provider, and then set the forms authentication credentials.
• B. From Active Directory Administrative Center, create a Password Setting object (PSO).
• C. Modify the Password Policy settings in a Group Policy object (GPO) that is linked to the domain, and then filter the GPO to Group1 only.
• D. From Windows PowerShell, run the Set-ADDomain cmdlet, and then run the Set-ADAccountPassword cmdlet.

Correct answer: B

Explanation

The correct answer is B, as creating a Password Setting Object (PSO) allows for fine-grained password policies that can be applied to specific groups, like Group1. Option A is irrelevant as it pertains to forms authentication rather than Active Directory password policies. Option C would apply to a broader scope than just Group1, affecting the entire domain. Option D involves cmdlets that do not specifically address setting a password change policy for a group.