When configuring AD, what can be added as exceptions?

• A. Organizational units
• B. Users
• C. Groups
• D. Computers

Answer: (A)

In AD configurations that involve filtering or scoping, an exception is typically a boundary you want to exclude from processing. Organizational units are the containers used to structure the directory and define administrative boundaries. Because you often want to exclude entire branches of AD from a sync or policy application, specifying an OU as an exception makes the most sense and is the most practical way to scope exclusions.

Users, groups, and computers are individual objects within those containers. Excluding them one by one is rarely desirable or feasible, whereas targeting at the OU level allows you to exclude large sections of AD with a single exception entry.