Your network contains an Active Directory domain named contoso.com. The domain contains 1,000 client
computers that run Windows 10.
A security audit reveals that the network recently experienced a Pass-the-Hash attack.
The attack was initiated from a client computer and accessed Active Directory objects restricted to the
members of the Domain Admins group.
You need to minimize the impact of another successful Pass-the-Hash attack on the domain. What should you
recommend?

A.
Move the computer accounts of all the client computers to a new organizational unit (OU). Remove the
permissions to the new OU from the Domain Admins
group.

B.
Configure the Domain Admins group as a restricted group.

C.
Instruct all administrators to use a restricted Remote Desktop connection when they sign in to a client
computer.

D.
Instruct all users to sign in to a client computer by using a Microsoft account

Explanation:
https://docs.microsoft.com/en-us/windows/access-protection/remote-credential-guard