Your network contains two Active Directory forests named contoso.com and adatum.com. Active  Directory Rights Management Services （AD RMS） is deployed in contoso.com. An AD RMS  trusted user domain （TUD） exists between contoso.com and adatum.com.    
From the AD RMS logs， you discover that some clients that have IP addresses in the  adatum.com forest are authenticating as users from contoso.com.    
You need to prevent users from impersonating contoso.com users.    
What should you do（）

Your network contains a single Active Directory domain. Active Directory Rights Management  Services （AD RMS） is deployed on the network.    
A user named User1 is a member of only the AD RMS Enterprise Administrators group. You need  to ensure that User1 can change the service connection point （SCP） for the AD RMS installation.  The solution must minimize the administrative rights of User1.    
To which group should you add User1（）