Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the users shown in following table. You have a workgroup server named Server1 that…

User1 only is unlikely correct unless User1 is the only user with a valid domain account in the new or parent domain, since promotion removes local accounts and only domain-authenticated users can sign in to a DC.

User3 only is incorrect if User3 was a local workgroup account on Server1, because all local SAM accounts are deleted during DC promotion when AD replaces the local SAM.

User1 and User2 only would be incorrect if either user was a local workgroup account rather than a domain account, since local accounts do not survive the promotion process.

User1 and User3 only is incorrect if User3 was a local account on the workgroup server, as it would have been removed when the SAM was replaced by Active Directory during promotion.

User3 and User4 only is incorrect if User3 and User4 were local accounts on the workgroup server, because those accounts are deleted when the server is promoted to a domain controller.

All four users cannot all sign in if any of them were local workgroup accounts that no longer exist after the SAM was replaced by Active Directory during DC promotion.