You are the network administrator for your company. Your network consists of a single Active Directory domain. All the user accounts, groups, and application servers of the human resources (HR) department are located in an organizational unit (OU) named HR. The managers in the HR department need access to the application servers to perform administrative tasks. A local group named HRManagers exists on each application server. The HRManagers local groups supply the permissions that the HR managers require. For security reasons, the company wants user accounts for managers in the HR department to be the only members of the HRManagers groups. You need to ensure that membership of the HRManagers group on each application server is as secure as possible. What should you do?

A.
Create a Group Policy object (GPO) that configures restricted groups for each HRManagers group. Link the GPO to the HR OU.

B.
Create a new OU for application servers under the HR OU, and move the servers to the new OU. Block permissions inheritance at the new OU.

C.
Create a universal group named HRManagers and make the user accounts for HR managers members of that group. Make the HRManagers universal group a member of the HRManagers local group on each application server.

D.
Create a script that adds the user accounts for managers in the HR department to the HRManagers local groups. Configure the script to act as the startup and shutdown script for the application servers.