220-1102 Question 64
Single answerDomain vs. workgroupA small accounting firm has 18 Windows 11 PCs that are currently configured in a workgroup. Each user has a separate local account on their computer, and the office manager wants employees to sign in with one username and password on any company PC. She also wants IT to enforce the same password policy and desktop restrictions across all systems from a central location. The firm has a Windows Server already available. Which solution best meets these requirements?
- A
Join all PCs to a domain and manage users and policies through Active Directory
- B
Keep the PCs in a workgroup and create identical local user accounts on every computer
- C
Enable Remote Desktop on each PC so IT can manually configure password settings and desktop restrictions
- D
Use a shared network folder for user profiles while keeping all PCs in the workgroup
Show answer and explanation
Correct answer: A
Explanation
The best answer is to join the computers to a domain and use Active Directory. In A+ Core 2, the key distinction is that a workgroup is designed for small peer-to-peer environments with decentralized administration, while a domain provides centralized authentication, authorization, and management. For the stated requirements, the organization needs domain-based user accounts and centralized policy control. In Microsoft best practices, Active Directory Domain Services combined with Group Policy is the standard way to manage user accounts, password policies, and desktop restrictions across multiple Windows systems in a business environment. A workgroup may be acceptable for very small, simple networks, but it does not provide centralized sign-in or centralized enforcement of security settings.
- A. Correct.
Correct. A Windows domain using Active Directory provides centralized authentication, allowing users to sign in with the same domain account on different joined PCs. It also supports centralized management through Group Policy, which can enforce password requirements, desktop restrictions, and other security settings across all domain-joined computers. This directly addresses both the single-sign-on style requirement within the organization and centralized administration.
- B. Incorrect.
Incorrect. A workgroup is a peer-to-peer model with no centralized authentication or policy management. Creating identical local accounts on each computer is labor-intensive, difficult to maintain, and does not provide true centralized control. Password changes, account lockouts, and policy enforcement would still need to be managed separately on each PC.
- C. Incorrect.
Incorrect. Remote Desktop can help administrators access systems remotely, but it does not provide centralized identity management or policy enforcement by itself. IT could manually configure each machine, but that would not meet the requirement for users to use one centrally managed account across any PC, nor would it scale well for ongoing administration.
- D. Incorrect.
Incorrect. A shared network folder can store files, and in some environments roaming-related technologies can be used with domains, but simply using a network share while staying in a workgroup does not provide centralized logon authentication or centralized policy enforcement. The core issue is identity and management, which a workgroup does not solve.