Once a domain has moved beyond the legacy File Replication Service, which is mandatory well before a domain can reach a Windows Server 2016 forest functional level, since FRS-based SYSVOL replication was deprecated and migration to DFSR-based SYSVOL is required at much lower functional levels, SYSVOL contents such as Group Policy Objects and logon scripts are kept synchronized across domain controllers by the DFS Replication service instead. Stopping the DFS Replication service specifically on DC1 halts SYSVOL replication on that domain controller, so GPOs and logon scripts stored there stop pulling updates from, or pushing updates to, its replication partners, which is exactly the intended and reversible action for isolating or troubleshooting a suspected SYSVOL replication problem without shutting the domain controller down entirely. DS Role Server is not an actual Windows service name relevant here, and the Background Intelligent Transfer Service handles unrelated background download throttling for things like Windows Update, so neither one plays any part in SYSVOL replication. The File Replication Service itself is also not the correct answer, since it is no longer the service used once the domain has already been migrated to DFSR- based SYSVOL replication at this functional level.

Explanation:
A standard Azure VM backup policy supports only one backup operation per day, so the most frequent schedule it can be configured to run at is once every 24 hours, and no more granular interval is exposed for that policy type regardless of how the schedule is configured. The enhanced backup policy, which was introduced to also add support for features such as protecting Trusted Launch virtual machines and taking multiple restore points within a single day, allows an hourly-style backup schedule with a configurable interval chosen from 4, 6, 8, 12, or 24 hours, giving it a minimum, and therefore most frequent, recovery point objective of 4 hours between backups. Selecting the enhanced policy and configuring it with the smallest available interval of 4 hours minimizes potential data loss far more effectively than the standard policy ' s once-daily cadence can, since a VM protected this way is never more than 4 hours behind its last successful recovery point, compared with up to a full day of exposure under the standard policy ' s single daily backup.

Explanation:
Organize users: Domain global. Assign permissions: Domain local.
This scenario is the classic AGDLP model (Accounts into Global groups into Domain Local groups, granted Permissions) extended across a forest trust. Contoso.com users must be added only to groups that live in the contoso.com forest, which points to a domain global group created in one of the contoso.com domains; global groups are specifically designed to hold user accounts from their own domain and to be referenced elsewhere, including across a trust. That global group is then nested inside a domain local group created in a fabrikam.
com domain, and permissions to the fabrikam.com resources are granted directly to that domain local group
- satisfying the requirement that permission grants happen only on fabrikam.com groups. Domain local groups can accept members from any domain in a trusted forest when a forest trust exists, which is exactly what allows the contoso.com global group to be nested inside the fabrikam.com domain local group despite the forest boundary. This achieves both constraints using only two groups total (one global, one domain local), which is the minimum possible, since eliminating either group would violate one of the two placement requirements (users must stay in a contoso.com group; permissions must land on a fabrikam.com group). A universal group is not needed and would not, by itself, reduce the group count below two.

Explanation:
Authentication policies, created and managed from the Active Directory Administrative Center ' s Authentication node, let an administrator set a maximum Kerberos ticket-granting-ticket lifetime for user, computer, or service accounts and define access-control conditions (device group membership or device claims) that a client must satisfy before a TGT is issued to it. This is distinct from an authentication policy silo, which groups accounts together to apply a shared policy rather than defining the TGT lifetime and device conditions itself. Because the requirement is specifically to set a TGT lifetime and device request conditions for high-privilege accounts, an authentication policy authored in ADAC is the object that implements both settings. Once the authentication policy is created, it is applied to the target high-privilege accounts (often through a policy silo membership for organizational grouping), and the domain controllers evaluate the policy
' s TGT lifetime and device claims during Kerberos authentication before issuing or renewing a ticket for those accounts.

Reset-ComputerMachinePassword is a PowerShell cmdlet designed specifically to reset a computer ' s domain account password directly against a specified domain controller, and when run locally on the affected computer itself, here Server1, targeting DC1 with -Server, it resets and resynchronizes the computer account ' s password on both sides of the secure channel: it generates a new password, writes it to the Server1$ computer account object on DC1, and simultaneously updates Server1 ' s own local machine-account secret to match, in a single coordinated operation. Because both the AD DS side and the local Server1 side of the shared secret end up holding the same new password value, the secure channel between Server1 and the domain is fully restored, resolving the trust relationship failed error. This is done without removing Server1 from the domain at any point, satisfying the stated constraint, and without changing any domain-wide or server-wide authentication policy setting. This cmdlet, along with Test-ComputerSecureChannel -Repair, is one of Microsoft ' s two documented, non-disruptive remediation methods for a broken computer secure channel, both of which succeed precisely because they update the password consistently on both the local computer and the domain controller rather than on only one side, unlike a solution that touches only the AD DS-stored value.