Chapter 8: Managing Users, Groups, and Devices

Question 1

How are custom attributes created?

Answer 1

Active Directory Schema snap-in, right-click on the Attributes container, and select the Create Attribute…

Question 2

How can custom attributes be synced to Entra ID?

Answer 2

Azure AD Connect “Directory extension attribute sync” feature.

Question 3

What are the benefits of Microsoft Managed Service Accounts (MSAs)?

Answer 3

• There is no more password management. MSAs use a complex and random, 240-character password that changes automatically when it reaches the domain or computer password expiry date.
• An MSA cannot be locked out or used for interactive login.
• A single MSA only can be used on one computer. It cannot be shared between multiple computers.
• An MSA provides simplified SPN management; the system will
  automatically change the SPN value if the SamAccountName details of the computer change or the DNS name property changes.

Question 4

Can a Managed Service Account (MSA) or Group Managed Service Account (gMSA) be made thru the AD UC GUI?

Answer 4

No, need to use PowerShell to create MSAs and GMSAs. It is not possible to create them using built-in GUI tools.

Question 5

Can a Managed Service Account (MSA) be used on multiple computers?

Answer 5

No, MSA can be used with one computer only.

Question 6

What are the benefits of Group Managed Service Accounts (gMSAs)?

Answer 6

• No password management
• Supports sharing across multiple hosts
• Can be used to run scheduled tasks (MSAs do not support the running of scheduled tasks)
• Uses Microsoft’s Key Distribution Center (KDC) to create and manage passwords for the gMSA

Question 7

Describe a “Domain local group”

Answer 7

Used to manage privileges to resources in a single domain as well as:

• User accounts from any trusted domain
• Computer accounts from any trusted domain
• Universal groups from any trusted forest
• Domain Local groups from the same domain
• Global groups from any trusted domain

Domain Local group objects and their membership data will be replicated to every domain controller in the same domain.

Question 8

Describe a “global group”

Answer 8

Used to manage privileges to resources in any
domain under the same forest; Global group objects and membership data will be replicated to every domain controller in the same forest

Question 9

Describe a “universal group”

Answer 9

Similar to Global groups, Universal groups can be used to
manage privileges in any domain in the forest. However, they allow you to have members from any domain.