What is the best way to accommodate 85 users with a distinct password and account lockout policy?

Creating a separate domain for the 85 users can be an effective way to manage distinct passwords and account lockout policies tailored specifically for them. By establishing a separate domain, you can enforce unique security settings, including password complexity and account lockout policies, without impacting the existing users or policies in other domains. This isolation allows for targeted administrative control, ensuring that the policies meant for these 85 users can be implemented and managed without interference from broader organizational policies.

This approach is particularly useful in environments where users require strict separation for compliance or security reasons, allowing for more granular control over user accounts. While other options might provide a way to manage accounts or enhance security, they would not offer the same level of customization or separation as creating a new domain specifically designed for these users.