220-1102 Question 488
Single answerRestrict log-in timesA small business uses Windows PCs joined to an Active Directory domain. Management wants temporary staff in the Reception group to be able to sign in only Monday through Friday from 8:00 a.m. to 5:00 p.m. A technician needs to enforce this without changing each workstation individually. Which action should the technician take?
- A
In Active Directory Users and Computers, open each temporary staff user account and configure Logon Hours for the allowed time range.
- B
In Local Security Policy on each receptionist PC, enable interactive logon restrictions for business hours only.
- C
Create a password policy requiring users to change passwords every day after 5:00 p.m.
- D
In Task Scheduler on the domain controller, create a task to sign users out of Windows at 5:00 p.m.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to configure Logon Hours on the affected domain user accounts in Active Directory Users and Computers. In a Windows domain, this is the standard administrative method for restricting when users may authenticate. It is centralized, aligns with least-privilege and account-control best practices, and avoids inconsistent settings across individual PCs. Microsoft documentation for Active Directory account properties includes Logon Hours as a user account restriction used to define permitted sign-in times. This is more appropriate than local workstation policy, password changes, or scheduled tasks, all of which fail to directly enforce the required domain authentication restriction.
- A. Correct.
Correct. In an Active Directory environment, logon time restrictions are configured on user accounts through Active Directory Users and Computers using the Logon Hours setting. This is the appropriate centralized method and does not require configuring every workstation individually. It directly addresses the requirement to restrict when the users are allowed to sign in.
- B. Incorrect.
Incorrect. Local Security Policy can control many local security settings, but it is not the correct tool for setting per-user domain logon hour restrictions across multiple computers. This choice reflects a common misconception that all sign-in controls are handled through local policies on endpoints.
- C. Incorrect.
Incorrect. Password policies govern password complexity, age, and related settings, not allowed sign-in times. Requiring frequent password changes would not prevent users from logging in outside approved hours and would create unnecessary administrative burden.
- D. Incorrect.
Incorrect. A scheduled task might be used to force logoff in some environments, but it does not properly enforce domain logon-hour restrictions and would not stop a user from attempting to sign in outside approved hours before the task runs. It is also less precise and less manageable than using the built-in account restriction.