How to Restrict Access to Windows Admin Center?
Short answer
D Add a security group to the allowed groups.
Question
Key Takeaways
Tests understanding of Windows Admin Center's explicit allow-list access model, where the common trap is assuming removing default user groups automatically restricts access.
Restricting access to Windows Admin Center requires explicitly assigning authorized security groups to the allowed groups list. Community consensus confirms that merely removing default groups like BUILTIN\Users is insufficient without adding a specific group.
Expert Analysis
Why the Answer Is Correct
Windows Admin Center utilizes an explicit allow-list architecture for authentication and authorization. Simply removing the default BUILTIN\Users group does not enable a deny-all policy; it merely removes that specific group from the whitelist. To enforce strict access control, administrators must explicitly add a targeted security group to the allowed groups configuration, ensuring only authorized identities can authenticate.
Why the Other Options Are Wrong
Option A configures performance optimization settings that affect UI responsiveness and resource consumption, not authentication. Option B controls credential elevation behavior for administrative tasks rather than initial console sign-in restrictions. Option C manages network routing rules for proxy connections and has zero impact on user access policies or identity verification within the application.
Community Comment Notes
The community unanimously selected option D, highlighting that explicit group assignment is mandatory after deleting defaults. Commenters referenced official Microsoft documentation detailing user access options, reinforcing that WAC defaults to permissive access unless a specific group is whitelisted. Multiple votes confirmed this behavior aligns with real-world deployment scenarios and exam objectives.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Focus on understanding explicit allow-list versus implicit deny models in modern Windows management tools. When configuring admin consoles, always verify how default permissions are evaluated and ensure authorized groups are explicitly added after modifying baseline configurations.
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Ni_yot 👍 2 Answered Dthere are a number of ways Windows Admin Center can be secured - https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/plan/user-access-options
-
stonwall12 👍 1 Answered DAnswer: D, security group After removing BUILTIN\Users, you must add a specific security group to the allowed groups list. Without adding an allowed group, Windows Admin Center defaults to allowing all users despite removing BUILTIN\Users. Adding a security group provides proper access control. Reference: https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/plan/user-access-options
-
Krayzr 👍 1 Answered DBy adding a specific security group to the allowed groups, you can control which users have access to Windows Admin Center. This ensures that only authorized users within that security group can sign in https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/plan/user-access-options
-
Ksk08 👍 3Answer should be D
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.