Identity with Windows Server 2016

To ensure User2 can add Group4 as a member of Group5, you need to modify the Managed By settings of Group5. In Active Directory, the Managed By tab allows you to specify a user or group that can manage the members of a particular group. By setting User2 as the manager of Group5, User2 will gain the necessary permissions to add Group4 to Group5.

To permit Admin1 to add Group2 to Group3, the group scope of Group3 must be changed. Currently, Group3 is a universal group. Universal groups can only have universal groups or global groups as members, not domain local groups like Group2. By altering Group3's scope to domain local, it will be permissible to add Group2 as a member.

To prevent the new users from accessing any of the resources in the domain after 90 days, you can use the Get-ADUser cmdlet to retrieve all user accounts in the Temp OU and pipe the output to the Set-ADUser cmdlet to set an expiration date for their accounts. This method ensures that after 90 days, the user accounts are expired and cannot access domain resources.