Your network consists of a single Active Directory domain. The relevant portion of the Active Directory domain is configured as shown in the following diagram.

The Staff organizational unit (OU) contains all user accounts except for the managers’ user accounts.

The Managers OU contains the managers’ user accounts and the following global groups:

– Sales
– Finance
– Engineering

You create a new Group Policy object (GPO) named GPO1, and then link it to the Employees OU.

Users from the Engineering global group report that they are unable to access the Run command on the Start menu. You discover that the GPO1 settings are causing the issue.

You need to ensure that the users from the Engineering global group are able to access the Run command on the Start menu.

What should you do?

A.
Configure GPO1 to use the Enforce Policy option.

B.
Configure Block Inheritance on the Managers OU.

C.
Configure Group Policy filtering on GPO1 for the Engineering global group.

D.
Create a new child OU named Engineering under the Employees OU. Move the Engineering global group to the new Engineering child OU.

Explanation:
MCITP Self-Paced Training Kit Exam 70-646 Windows Server Administration

No administrator likes exceptions, but we are required to implement them. Typically you might have configured security filtering, Windows Management Instrumentation (WMI) filters, block inheritance settings, no-override settings, loopback processing, and slow-link settings. You need to check that these settings are not affecting normal GPO processing.