You are the network administrator for a bank that has a main office and many small branch offices. The
bank’s network consists of a single Active Directory domain. All servers run Windows Server 2003. The
domain has an organizational unit (OU) for each branch office. Group Policy objects (GPOs) linked to these
OUs are used to configure bank resources. Under each branch office’s OU, there is an OU named
UserAccounts that contains user accounts and an OU named Workstations that contains client computer
accounts. A single administrative user at each branch office provides desktop support and administration for
the branch office. The number of support calls for the branch office administrators recently increased
because users are making configuration changes to their computers. You need to restrict desktop features
and administrative tools for all users except the administrative user in each branch office. You create a GPO
that applies the desktop restrictions. What else should you do?

A.
Link the GPO to each branch office’s Workstations OU. Create an OU underneath each branch office’s
Workstations OU and move the administrative user’s computer account into the new OU. Block GPOs
from applying to the new OU.

B.
Link the GPO to each branch office’s UserAccounts OU. Create an OU underneath each branch office’s
UserAccounts OU and move the administrative user’s account into the new OU.
Block GPOs from applying to the new OU.

C.
Link the GPO to each branch office’s Workstations OU. Filter the GPO on the administrative user’s
computer for each branch office, so that the computer does not apply the new GPO.

D.
Link the GPO to each branch office’s UserAccounts OU. Filter the GPO on the administrative user’s
account for each branch office, so that the user account does not apply the new GPO.