A privileged account's old password was last changed on a DC that did not produce usable AES keys. What should be verified before Protected Users membership?

Choose the single best answer.

A.Change the password on a suitable DC and verify AES Kerberos authentication
B.Disable Kerberos preauthentication to avoid key requirements
C.Enable DES-only authentication for the account
D.Add the account to a broad RODC allowed list

Show the answer and explanation

✓ Correct answer

Change the password on a suitable DC and verify AES Kerberos authentication

AES key readiness supports permitted Kerberos authentication. DES-only or preauthentication removal weakens or conflicts with the required path; RODC caching does not create the required AES readiness.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.