220-1102 Question 165
Single answerDomain joined vs. workgroupA small accounting firm has 12 Windows 11 PCs that are currently configured in a workgroup. The office manager wants employees to sign in with one company username and password on any office PC, and wants IT to enforce the same password and desktop security settings across all systems from a central location. Which solution best meets these requirements?
- A
Keep the PCs in a workgroup and create identical local user accounts on each computer
- B
Join the PCs to a domain and manage users and policies through Active Directory
- C
Enable Remote Desktop on each PC so employees can access their usual computer from anywhere in the office
- D
Create a shared folder on one PC and have all employees store their profile settings there
Show answer and explanation
Correct answer: B
Explanation
The best answer is to join the PCs to a domain and manage them through Active Directory. In a workgroup, each computer maintains its own local user accounts and local security settings, which does not scale well when users need to log on to multiple PCs with the same credentials. In a domain environment, user accounts are centrally managed, and administrators can enforce consistent security and desktop settings with Group Policy. This aligns with Microsoft best practices for organizations that need centralized authentication, authorization, and policy management. For A+ Core 2, candidates should recognize that workgroups are appropriate for small, loosely managed peer-to-peer environments, while domains are intended for centralized administration in business settings.
- A. Incorrect.
This is incorrect because a workgroup uses local accounts that are managed separately on each computer. Even if the technician manually creates matching usernames and passwords on every PC, authentication is still local to each machine, and settings such as password requirements and desktop restrictions are not centrally enforced in the same way as in a domain. This option reflects a common misconception that identical local accounts provide the same centralized management as domain accounts.
- B. Correct.
This is correct because a Windows domain provides centralized authentication and management. By joining the PCs to a domain, users can sign in with domain accounts on different computers, and IT can apply consistent settings through Group Policy. This directly addresses the need for one company username and password across multiple PCs and centralized enforcement of security settings.
- C. Incorrect.
This is incorrect because Remote Desktop allows remote access to a specific computer, but it does not provide centralized identity management or policy enforcement across all PCs. Employees would still be tied to their assigned systems rather than using a single account on any office PC. Someone might choose this option because it sounds like it increases flexibility, but it does not solve the domain-versus-workgroup requirement.
- D. Incorrect.
This is incorrect because shared folders can centralize files, but they do not centralize Windows authentication or system policy management. Storing profile-related data on a share does not replace domain logons, Active Directory, or Group Policy. This distractor targets the misunderstanding that file sharing alone can provide the benefits of a managed domain environment.