Your company has a single Active Directory directory service domain with several top-level organizational units (OUs). There is one OU for each of the major departments, and an OU named Network Security. All user accounts are placed into their respective department OUs. You create a group named Help Desk, and you place the user accounts for help desk technicians into this group. You need to allow the help desk technicians to administer all user accounts except the accounts in the Network Security OU. Your solution must also allow the help desk technicians to administer accounts in future new top-level OUs without requiring the necessary rights to be manually assigned. What should you do?

A.
At the domain level, assign the Help Desk group the Create, delete, and manage accounts permission. At the Network Security OU, block permission inheritance.

B.
At the domain level, assign the Help Desk group the Create, delete, and manage accounts permission. At the Network Security OU, block Group Policy inheritance.

C.
At the department-level OUs, assign the Help Desk group the Create, delete, and manage accounts permission. At the Network Security OU, block permission inheritance.

D.
At the department-level OUs, assign the Help Desk group the Create, delete, and manage accounts permission. At the Network Security OU, block Group Policy inheritance.