There is a scenario in windows server 2016 and I need to do it, can you show it with screenshots if possible, thanks in advance

Install AD DS(active directory domain services), DNS, and DHCP to your first server and promote it to Domain Controller.

You should configure DNS Forward and Reverse lookup zones.

You should configure DHCP: configure new scope which will cover your two w10 pc, reserve their IP numbers to these pcs, but not activate the scope. For the time being, you should give static IP numbers to all of your 2 w10s and 2 servers

Add your second server and two windows10 PCs to your domain

Using group policy manager create a domain password group policy so that users will not need immediately be able to reuse their previous password. Password Length should be at least 7 characters. Passwords must meet complexity requirements.

and Create an OU (organizational unit ) named as OU2

1. Under OU2 create sub Ous

1. HROU

Create a HRUserGroup

Create a HRUser1 here and add this user to HRUserGroup

Create a GPO for this HROU users that they will not be able to run TASK MANAGER.

Have this user to login to the first w10 client and not be able to use task manager

2. ITOU

Create a ITUserGroup

Create a ITUser1 here and add this user to ITUserGroup

Create GPO for this ITOU users that they will see a different wallpaper that the others when they login to sytem. (either use one of the image file under windwos folder or download an image from internet and use it.)

Have this user to login to second w10 client and see this new wallpaper.

3. salesOU

create a salesuserGroup

create a salesuser1 here and add this user to ITUserGroup