You are the network administrator for your company. The network consists of a single Active Directory
domain. The company’s written domain administration policy requires that help desk employees must have the ability to reset passwords.

The help desk employees must be able to reset passwords for all user accounts except for members of the Domain Admins global group and members of the Executives global group. The help desk employees must not have any other administrative rights in the domain. All help desk employees are members of the Help Desk global group. All members of the Domain Admins group are located in an organizational unit (OU) named AdminsOU. All members of the Executives group are located in an OU named ExecutiveOU. All other user accounts are located in an OU named EmployeesOU.

The relevant portion of the OU design for the domain is shown in the exhibit.

You need to configure the permissions for the help desk employees as defined by the written domain administration policy.

What should you do?

A.
Assign the Help Desk global group the right to reset passwords in the OU named AllUsersOU.

B.
Assign the Help Desk global group the right to reset passwords in the OU named EmployeesOU.

C.
Assign the Help Desk global group the right to manage user accounts at the domain level.
Deny the help desk employees the right to reset passwords in the OU named AdminsOU and the OU
named ExecutiveOU.

D.
Assign the Help Desk global group the right to manage user accounts in the OU named AllUsersOU.
Block the inheritance of permissions at the OU named AdminsOU and the OU named ExecutiveOU.