220-1102 Question 387
Single answerMoving objects within organizational unitsA technician is updating Active Directory after the accounting department was reorganized. Several user accounts are currently in the Sales organizational unit (OU), and company policy requires those users to receive Accounting-specific Group Policy settings immediately. The technician has permission to manage users in both OUs. Which action should the technician take to meet the requirement with the least administrative effort?
- A
Move the user accounts from the Sales OU to the Accounting OU in Active Directory Users and Computers
- B
Create new accounting user accounts in the Accounting OU and disable the old sales accounts
- C
Add the users to the Accounting security group and leave the accounts in the Sales OU
- D
Restart each user's workstation so the domain automatically relocates the accounts to the correct OU
Show answer and explanation
Correct answer: A
Explanation
The correct solution is to move the existing user accounts into the Accounting OU. In Active Directory Domain Services, OUs are administrative containers used to organize users, computers, and groups, and they are commonly used to scope Group Policy application and delegated administration. When a user object is moved into a different OU, it becomes subject to the policies linked to that OU, subject to normal Group Policy processing rules. This is the least disruptive and most efficient method because it retains the same user account rather than replacing it. Microsoft documentation for Active Directory Users and Computers and Group Policy management supports organizing objects within OUs and moving them as business needs change.
- A. Correct.
This is correct. In an Active Directory environment, moving the existing user objects from one OU to another is the proper way to place them under the target OU so they inherit the Group Policy Objects linked to that OU. This preserves the existing accounts, SIDs, profiles, and access assignments while applying the new OU-based administration and policy structure.
- B. Incorrect.
This is incorrect. Creating new accounts would create unnecessary administrative overhead and can cause problems with permissions, profiles, mailbox associations, mapped resources, and audit history. Best practice is to move the existing object when the employee remains the same person and only the department or administrative container changes.
- C. Incorrect.
This is incorrect. Security group membership can be used for assigning permissions and, in some environments, filtering certain policies, but it does not change the OU location of the user object. If the requirement is to receive Accounting-specific settings tied to the Accounting OU, leaving the account in the Sales OU does not satisfy that organizational placement requirement.
- D. Incorrect.
This is incorrect. Restarting the workstation affects the client device, not the location of the user object in Active Directory. User and computer objects are not automatically moved between OUs based on department changes or workstation restarts. An administrator must manually move the object or use an administrative tool/script to do so.