Which method is used to disable a user account in Active Directory?

Disabling a user account in Active Directory is best accomplished by selecting the account and choosing the "Disable Account" option. This action directly modifies the user account's status within the Active Directory environment, effectively preventing the user from logging in or accessing resources associated with the account without deleting the account or any of its associated data and settings.

By doing this, the account can be re-enabled later if necessary, allowing for flexibility in managing user access. This method is straightforward and communicates clear intent regarding the account's status; it provides visibility to administrators that the account is intentionally disabled, rather than simply being inactive because of other factors, such as a password change or removal from a group.

Changing the password alone does not disable the account; it merely alters the authentication method for the user. Similarly, removing a user from a group could limit their access to resources but does not prevent them from logging into the system altogether. Logging out a user from their session only affects the current login and does not change the account's status in Active Directory, allowing the user to log in again later.

Therefore, the most definitive and effective way to disable a user account is indeed to select the account and choose the "Disable Account" option.