In the contoso.com domain (FFL: Windows Server 2016), two fine-grained password policies exist: PSO_User (msDS-PasswordSettingsPrecedence=10) is directly applied to user Alice, and PSO_GG (msDS-PasswordSettingsPrecedence=20) is applied to the global security group GG_Sales. Alice is a member of GG_Sales. Security requires that the group-based PSO_GG becomes the effective password policy for Alice without removing the direct PSO assignment. You also need to verify the resultant PSO for Alice. Which two actions should you perform?

To make PSOGG the effective policy for Alice, its precedence must be higher (lower numerical value) than PSOUser. Fine-grained password policies (FGPPs) are applied based on a specific order: direct assignment, then global groups, then universal groups. If multiple PSOs apply, the one with the lowest msDS-PasswordSettingsPrecedence value takes effect. Since PSOUser has a precedence of 10, lowering PSOGG's precedence to a value less than 10 (e.g., 5) will ensure it overrides PSOUser for Alice. The Get-ADUserResultantPasswordPolicy cmdlet is the correct tool to verify the effective password policy for a user, confirming that the changes have the desired effect. Linking PSOGG to an OU or adding Alice to a special group are not valid methods for overriding directly assigned PSOs or manipulating FGPP precedence.