Chapter 9 - Install and Configure Active Directory Domain Services (AD DS) Flashcards
You are the administrator for your company network. Your company has one Active Direc- tory Domain Services (AD DS) forest that contains two domains. All servers run Windows Server 2016. The company uses iSCSI storage and Fibre Channel storage. You plan to deploy a single Hyper-V failover cluster that uses Cluster Shared Volumes (CSV). The clus- ter must include virtual machines from both domains. What should you do if you need to ensure that you can deploy a failover cluster?
A. Deploy clustered storage spaces.
B. Deploy Serial Attached SCSI (SAS).
C. Join each Hyper-V host server to the same AD DS domain.
D. Join each Hyper-V host server to different AD DS domains.
C. All servers in the cluster must be in the same Active Directory domain. As a best practice, all clustered servers should have the same domain role (either member server or domain controller). The recommended role is member server
You are the administrator for your company network. Your network contains an Active Directory domain. The domain contains a Read-Only Domain Controller (RODC) named RODC1. What should you run if you need to retrieve a list of accounts that have their pass- words cached on RODC1? A. dcdiag.exe B. netdom.exe C. ntdsutil.exe D. repadmin.exe
D. repadmin.exe is a command-line tool that can assist administrators in diagnosing rep- lication problems between Windows domain controllers. Administrators can use Repadmin to retrieve a list of accounts that have their passwords cached on an RODC. Repadmin.exe can also be used for monitoring the relative health of an Active Directory forest.
You are the administrator for your company network. Your network contains an Active Directory domain. All users are in an organizational unit (OU) named CorpUsers. You plan to modify the description of all the users who have a string of 603 in their mobile phone numbers. What PowerShell cmdlet should you run if you need to view a list of the users who will be modified?
A. Get-ADUser-Filter “MobilePhone-like ‘603’”
B. Get-ADOrganizationalUnit-Filter “MobilePhone-like ‘603 “’ C. Get-ADUser-LDAPFilter “(MobilePhone=’603)”
D. Get-ADOrganizationalUnit-LDAPFilter “(MobilePhone=’603’)”
A. The Get-ADUser cmdlet gets a specified user object or performs a search to get multiple user objects. To search for and retrieve more than one user, use the Filter or LDAPFilter parameters. -Filter specifies a query string that retrieves Active Directory objects.
You are the administrator for your company network. Your company is always changing, with new employees coming and going. One of your common tasks requires the deletion of user accounts for employees who are no longer with the company. What command can you use to delete user accounts? A. dsmod B. dspromo C. LDIFDE D. netsh
C. LDAP Data Interchange Format Directory Exchange (LDIFDE.exe) is a powerful util- ity that can be useful in adding, deleting, and modifying user accounts in Active Directory. This utility enables you to import/export information from/to Active Directory. LDIFDE queries any available domain controller to retrieve or update AD information.
You are the administrator for your company network. Your network contains an Active Direc-
tory forest. What should you do if you need to identify which server is the schema master?
A. Run Get-ADDomainController -Discover -Service using PowerShell.
B. Run netdom query fsmo using an elevated command prompt.
C. Open Active Directory Users and Computers, right-click the forest in the console tree, and click Operations Master.
D. Open Active Directory Users and Computers, right-click the forest in the console tree, and click RID Master.
B. You can open an elevated command prompt and execute the command netdom query fsmo. This will list the FSMO role holder server. It will show you the five FSMO roles:
■■ Schema Master—Forest-wide and one per forest
■■ Domain Naming Master—Forest-wide and one per forest
■■ RID Master—Domain-specific and one for each domain
■■ PDC—Domain-specific and one for each domain
■■ Infrastructure Master—Domain-specific and one for each domain
You re the administrator for your company network. You have the Active Directory Recycle Bin enabled. You discover that a colleague accidentally removed 100 users from an Active Directory group named Group1 an hour ago. What should you do if you need to restore the membership of Group1?
A. Perform tombstone reanimation.
B. Export and import data by using Dsamain.
C. Perform a nonauthoritative restore.
D. Recover the items by using Active Directory Recycle Bin.
B. This is a trick question because a group has been modified but nothing has been deleted.
Therefore, options A and D will not work. Option C would work if it was an authoritative restore, but it won’t work for a nonauthoritative restore. The solution is to recover an earlier copy of the group from a backup or Active Directory checkpoint by using Dsamain.
You are the administrator for your company network. You have recently implemented Win- dows Server 2016. You have a few remote sites that are not very secure. You have decided to implement Read-Only Domain Controllers (RODCs). To do the installation of the RODCs, what forest and functional levels does the network need? (Choose all that apply.) A. Windows Server 2016 B. Windows Server 2008 R2 C. Windows Server 2012 R2 D. Windows Server 2008
A, B, C, D. To install an RODC, ensure that the forest and functional levels are Windows 2003 or newer.
You are the administrator for your company network. What is the maximum number of domains that a Windows Server 2016 computer configured as a domain controller may participate in at one time? A. Zero B. One C. Two D. Any number of domains
B. A domain controller can contain Active Directory information for only one domain. If you want to use a multidomain environment, you must use multiple domain controllers configured in either a tree or a forest setting.
You are the administrator for your company network. Your network contains a single Active Directory domain. The domain contains five Windows Server 2008 R2 domain controllers. What should you perform if you plan to install a new Windows Server 2016 domain controller? (Choose two.)
A. Run adprep.exe /rodcprep at the command line.
B. Run adprep.exe /forestprep at the command line.
C. Run adprep.exe /domainprep at the command line.
D. Raise the functional level of the domain from Active Directory Domains and Trusts.
E. Prestage the RODC computer account from Active Directory Users and Computers.
B, C. You need to run the adprep command when installing your first Windows Server 2016 domain controller onto a Windows Server 2008 R2 domain. If you are doing an in-place upgrade of an existing domain controller to the Windows Server 2016 operating system, you will need to run adprep /forestprep and adprep /domainprep manually. adprep /forestprep needs to be run only once in the forest. adprep /domainprep needs to be run once in each domain in which you have domain controllers that you are upgrad- ing to Windows Server 2016. adprep /rodcprep gets the network ready to install a read- only domain controller and not a GUI version.
You are the administrator for your company network. Your network has a single Active Directory domain. A user who has left the company returns after eight weeks. The user tries to log on to her old computer and receives an error stating that authentication has failed. The user’s account has been enabled. What should you do if you need to ensure that the user is able to log on to the domain using that computer?
A. Re-create the user account and then reconnect the user account to the computer account.
B. Reset the computer account in Active Directory. Disjoin the computer from the domain and then rejoin the computer to the domain.
C. Rejoin the computer account by running the Adadd command.
D. Run the MMC utility on the user’s computer and add the Domain Computers snap-in.
B. A computer account and the domain authenticate each other by using a password. The password resets every 30 days. Since the machine has not connected to the domain for eight weeks, the computer needs to be rejoined to the domain.
You are the administrator for your company network. Your network contains an Active Directory domain that includes 1,000 desktop computers and 500 laptops. An organiza- tional unit (OU) named OU1 contains the computer accounts for the desktop computers and the laptops. You create a PowerShell script named Script1.ps1 that removes tem- porary files and cookies. You create a Group Policy Object (GPO) named GPO1 and link GPO1 to OU1. What should you do if you need to run the script once a week on the laptops only?
A. Add Script1.ps1 as a startup script and attach a WMI filter to GPO1.
B. Create a File preference that uses item-level targeting in GPO1.
C. Create a Scheduled Tasks preference that uses item-level targeting in GPO1.
D. Configure the File System security policy and attach a WMI filter to GPO1.
C. Item-level targeting is a feature of Group Policy preferences that allows preference set- tings to be applied to individual users and/or computers within the scope of the GPO that contains the preferences. Item-level targeting allows an administrator to specify a list of conditions that must be met in order for a preference setting to be applied to a user or computer object. The Scheduled Tasks preference items let you create, replace, update, and delete scheduled tasks and their associated properties.
You are the administrator for your company network. Your network contains an Active Directory forest. The forest contains a domain named abc.com. The domain contains three domain controllers. A domain controller named DC1 fails and you are unable to repair it. What should you do if you need to prevent the other domain controllers from attempting to replicate to DC1?
A. Remove the object of DC1 from Active Directory Sites and Services.
B. Remove the computer account of DC1 from Active Directory Users and Computers.
C. Transfer the operations master roles from DC1 from Active Directory Domains and Trusts.
D. Perform a metadata cleanup using ntdsutil.exe.
D. To prevent replicating data between a broken domain controller and the rest, you will need to perform a metadata cleanup. This can be done using ntdsutil.exe on any workstation/ server in a network. Metadata cleanup removes all the references to the domain controller from Active Directory so that tasks like replication continue to work without any errors.
You are the administrator for your company network. You have an offline root certification authority (CA) named CA1. CA1 is hosted on a virtual machine. You only turn on CA1 when the CA must be patched or when you must generate a key for subordinate CAs. You start CA1, and you discover that the filesystem is corrupted. You resolve the filesystem cor- ruption and discover that you must reload the CA root from a backup. When you attempt to run the Restore-CARoleService cmdlet, you receive the following error message: “The process cannot access the file because it is being used by another process.” What should you do first to resolve the issue?
A. Stop the Active Directory Domain Services (AD DS) service.
B. Stop the Active Directory Certificate Services (AD CS) service.
C. Run the Restore-CARoleService cmdlet and specify the path to a valid CA key.
D. Run the Restore-CARoleService cmdlet and specify the Force parameter.
B. You will need to stop the Active Directory Certificate Services (AD CS) service prior to running the Restore-CARoleService cmdlet. If you’re using the Restore-CARoleService cmdlet and you receive the error message “The process cannot access the file because it is being used by another process,” you need to stop the Active Directory Certificate Services (AD CS) service first.
You are the administrator for your company network. Your network contains an Active Directory domain. What tool should you use if you need to limit the number of Active Directory Domain Services (AD DS) objects that a user can create in the domain? A. Active Directory Administrative Center B. Active Directory Users and Computers C. Dsacls D. dsadd_quota E. Dsamain F. Dsmod G. Group Policy Management Console H. Ntdsutil
D. You can use Active Directory and Active Directory Domain Services (AD DS) to imple- ment limitations on the number of objects that a security principal (a user, computer, and group) can create in a directory node. You can define these limitations through Active Directory quotas. dsadd_quota adds a quota specification to a directory partition. A quota specification determines the maximum number of directory objects a given security princi- pal can own in a specified directory partition.
You are the administrator for your company network. Your network contains an Active Directory domain.
You have an organizational unit (OU) named OU1 that contains the computer accounts of two servers and the user account of a user named User1. A Group Policy Object (GPO) named GPO1 is linked to OU1. You have an application named App1 that installs by using an application installer named App1.exe. What should you do if you need to publish App1 to OU1 by using Group Policy?
A. Create a Config.zap file and add a file to the File System node to the Computer Configuration node of GPO1.
B. Create a Config.xml file and add a software installation package to the User Configu- ration node of GPO1.
C. Create a Config.zap file and add a software installation package to the User Configu- ration node of GPO1.
D. Create a Config.xml file and add a software installation package to the Computer Configuration node of GPO1.
C. The Group Policy Software installation extension allows administrators to use the Group Policy Object Editor to centrally manage the installation of software on all client computers in an organization. When Group Policy is used to deploy software and the software is included in the GPO linked to a site, domain, or OU, the software is referred to as being advertised to the user and computer. If you’re assigning the application to a user, use the Software Installation node under the User Configuration node, Software Settings. If you’re assigning the application to a computer, use the Software Installation node under Computer Configuration, Software Settings. A .zap package is a simple text wrapper around a setup command. This information is extracted directly by the Group Policy Software installation extension.
You are the administrator for your company network. Your network contains an Active Directory forest named abc.com. The forest contains three domains named abc.com, corp.abc.com, and office.abc.com. The forest contains three Active Directory sites named Site1, Site2, and Site3. You have the three administrators as described in the following table:
Administrator Name Group Membership Domain
Admin1 Domain Admins abc.com
Admin2 Domain Admins corp.abc.com
Admin3 Enterprise Admins abc.com
You create a Group Policy Object (GPO) named GPO1. Who can link GPO1 to Site2? A. Admin1 and Admin2 only B. Admin1 and Admin3 only C. Admin1, Admin2, and Admin3 D. Admin3 only
B. By default, only domain administrators and enterprise administrators have this privilege for domains and OUs. Enterprise administrators and domain administrators of the forest root domain have this privilege for sites.
You are the administrator for your company network. Your network contains an Active Directory domain that has 5,000 user accounts. You have a Group Policy Object (GPO) named DomainPolicy that is linked to the domain and a GPO named DCPolicy that is linked to the Domain Controllers organizational unit (OU). What should you do if you need to use the application control policy settings to prevent several applications from running on the network?
A. Modify Administrative Templates from the Computer Configuration node of DomainPolicy.
B. Modify Administrative Templates from the User Configuration node of DomainPolicy.
C. Modify Folder Redirection from the User Configuration node of DomainPolicy.
D. Modify Security Settings from the Computer Configuration node of DCPolicy.
E. Modify Security Settings from the Computer Configuration node of DomainPolicy.
F. Modify Security Settings from the User Configuration node of DCPolicy.
G. Modify Windows Settings from Preferences in the User Configuration node of
DomainPolicy.
H. Modify Windows Settings from Preferences in the Computer Configuration node of DomainPolicy.
E. You would want to modify the security settings from the Computer Configuration node of the GPO named DomainPolicy. Configuring Group Policy settings enables you to cus- tomize the configuration of a user’s desktop, environment, and security settings. The actual settings are divided into two subcategories: Computer Configuration and User Configura- tions. The subcategories are referred to as Group Policy nodes. A node is simply a parent structure that holds all related settings. In this case, the node is specific to Computer Con- figurations and User Configurations.
You are the administrator for your company network. Your network contains an Active Directory forest and the functional level is Windows Server 2016. What tool should you use if you need to ensure that a domain administrator can recover a deleted Active Directory object quickly? A. Active Directory Administrative Center B. Active Directory Users and Computers C. Dsacls D. dsadd_quota E. Dsamain F. Dsmod G. Group Policy Management Console H. Ntdsutil
A. You can restore objects from the Active Directory Recycle Bin by using Active Directory Administrative Center. Starting with Windows Server 2012, the Active Directory Recycle Bin feature was enhanced with a new graphical user interface for users to manage and restore deleted objects. Users can now visually locate a list of deleted objects and restore them to their original or desired locations.
You are the administrator for your company network. Your network contains an Active
Directory domain. You recently deleted 5,000 objects from the Active Directory database. You need to reduce the amount of disk space used to store the Active Directory database on a domain controller. What tool should you use?
A. Active Directory Administrative Center
B. Active Directory Users and Computers
C. Dsacls
D. dsadd_quota
E. Dsamain
F. Dsmod
G. Group Policy Management Console
H. Ntdsutil
H. Ntdsutil is the primary method by which system administrators can do offline main- tenance. It is a command-line tool that is run at an elevated command prompt. The main utility we use for offline maintenance is Ntdsutil. You can use the defragmentation process to compact the Active Directory database when it’s offline. Offline defragmentation helps return free disk space and check Active Directory database integrity. When you perform a defragmentation of the Active Directory database, a new, compacted version of the data- base is created. This new database file can be created on the same machine (if space per- mits) or on a network location. After the new file is created, copy the compacted Ntds.dit file back to the original location.
You are the administrator for your company network. Your network contains an Active
Directory domain. The domain functional level is Windows Server 2016. Your company hires a new security administrator to manage sensitive user data. You create a user account named Security1 for the security administrator. What tool should you use if you need to ensure that the password for Security1 has at least 12 characters and is modified every
10 days and the solution must apply to Security1 only?
A. Active Directory Administrative Center
B. Active Directory Users and Computers
C. Dsacls
D. dsadd_quota
E. Dsamain
F. Dsmod
G. Group Policy Management Console
H. Ntdsutil
A. To enable Fine-Grained Password Policies (FGPPs), you need to open the Active Directory Administrative Center. Using FGPPs, you specify multiple password policies in a single domain and apply different restrictions for password and account lockout policies to differ- ent sets of users in a domain. You can apply stricter settings to privileged accounts and less strict settings to the accounts of other users.
You are the administrator for your company network. You are trying to determine which filesystem to use for a server that will become a Windows Server 2016 file server and domain controller. The company has the following requirements:
■✓ The filesystem must allow for file-level security from within Windows 2016 Server.
■✓ The filesystem must make efficient use of space on large partitions.
■✓ The domain controller Sysvol must be stored on the partition.
Which of the following filesystems meets these requirements?
A. File Allocation Table (FAT)
B. File Allocation Table 32 (FAT32)
C. High Performance File System (HPFS)
D. New Technology File System (NTFS)
D. NTFS has file-level security and makes efficient use of disk space. Since this machine is to be configured as a domain controller, the configuration requires at least one NTFS partition to store the SYSVOL information.
You are the administrator for your company network. You deploy a new Active Directory forest. You need to ensure that you can create a Group Managed Service Account (gMSA) for multiple member servers. What should you do?
A. Configure Kerberos constrained delegation on the computer account of each member server.
B. Configure Kerberos constrained delegation on the computer account of each domain controller.
C. Run the Set-KdsConfiguration PowerShell cmdlet on a domain controller.
D. Run the Add-KdsRootKey PowerShell cmdlet on a domain controller.
D. The first step in creating a gMSA is to create the KDS Root Key. Use the Add-KdsRootKey cmdlet to generate a new root key for the Microsoft Group Key Distribution Service (KdsSvc) within Active Directory. The Microsoft Group KdsSvc generates new group keys from the new root key.
You are the administrator for your company network. You think you may have an issue with name resolution, and you need to verify that you are using the correct host name. You want to test DNS on the local system and see whether the host name Server1 resolves to the IP address 10.1.1.1. Which of the following provides a solution to the problem?
A. Add an A record to the local WINS server.
B. Add a DNS server to the local subnet.
C. Add the mapping for the host name Server1 to the IP address 10.1.1.1 in the local sys- tem’s HOSTS file.
D. Add an MX record to the local DNS server
C. The HOSTS file is a text-file-based database of mappings between host names and IP addresses. It works like a file-based version of DNS. DNS resolves a host name to an IP address.
You are the administrator for your company network. You have one Active Directory forest in your organization that contains one domain named abc.com. You have two domain con- trollers configured with the DNS role installed. There are two Active Directory integrated zones named abc.com and abcAD.com. One of your colleagues, who is not an administra- tor, needs to be able to modify the abc.com DNS server, but you need to prevent this user from modifying the abcAD.com SOA record. What should you do?
A. Modify the permissions of the abc.com zone from the DNS Manager snap-in.
B. Modify the permissions of the abcAD.com zone from the DNS Manager snap-in.
C. Run the Delegation Of Control Wizard in Active Directory.
D. Run the Delegation Of Control Wizard in the DNS snap-in
A. You only need to give them rights to the abc.com zone using the DNS snap-in. If they do not have any rights to the abcAD.com zone, they will not be able to configure this zone in any way.
You are the administrator for your company network. You and a colleague are discussing Active Directory protocols and services. Which of the following protocols and services are required in order to support Active Directory? (Choose two.) A. DHCP B. DNS C. IPX/SPX D. NetBEUI E. TCP/IP
B, E. The use of DNS and TCP/IP is required to support Active Directory. TCP/IP is the network protocol favored by Microsoft, which determined that all Active Directory com- munication would occur on TCP/IP. DNS is required because Active Directory is inherently dependent on the domain model. DHCP is used for automatic address assignment and is not required. Similarly, NetBEUI and IPX/SPX are not available network protocols in Windows Server 2016.
You are the administrator for your company network. The network contains an Active Directory forest. The forest contains three domain controllers configured as shown:
Server Name Active Directory Site
Server1 Boston
Server2 Boston
Server3 New York
The company physically relocates Server2 from the Boston office to the New York office. You discover that both Server1 and Server2 authenticate users who sign in to the client computers in the Boston office. Only Server3 authenticates users who sign in to the comput- ers in the New York office. What should you do if you need to ensure that Server2 authenti- cates the users in the New York office during normal network operations?
A. Modify the Internet Protocol Version 4 (TCP/IPv4) configuration from Network Connections on Server2.
B. Modify the Location Property of Server2 from Active Directory Users and Computers.
C. Run the Move-ADDirectoryServer cmdlet.
D. Run the Set-ADReplicationSite cmdlet.
D. The Set-ADReplicationSite cmdlet is used to set the properties for an Active Direc- tory site that is being used for replication. Sites are used in Active Directory to either enable clients to discover network resources (published shares, domain controllers) close to the physical location of a client computer or to reduce network traffic over wide area network (WAN) links. Sites can also be used to optimize replication between domain controllers.
You are the administrator for your company network. Your network contains an Active Directory domain. The domain contains a web application that uses Kerberos authentica- tion. You change the domain name of the web application. What tool should you use if you need to ensure that the Service Principal Name (SPN) for the application is registered? A. Active Directory Users and Computers B. dnscmd C. LDIFDE D. rdspnf
A. An SPN is a unique identifier of a service instance. SPNs are used by Kerberos authen- tication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name. To see if the SPNs are registered, you can use Active Directory Users and Computers.
You are the administrator for your company network. Your network contains an Active Directory domain. What should you use if you need to create a Central Store for Group Policy administrator templates?
A. dcgpofix.exe
B. File Explorer
C. Group Policy Management Console (GPMC)
D. Server Manager
B. Administrative Template files are divided into .admx files and language-specific .adml files for use by Group Policy administrators. To create a central store for .admx and .adml files, create a new folder in File Explorer that is named PolicyDefinitions on the domain controller—for example, \abc.com\SYSVOL\abc.com\policies\PolicyDefinitions.
You are the administrator for your company network. Your network contains an Active Directory domain. What should you use if you need to create a Central Store for Group Policy administrator templates?
A. Copy-GPO
B. Copy-Item
C. dcgpofix.exe
D. Group Policy Management Console (GPMC)
B. The Copy-Item cmdlet copies an item from one location to another in the same namespace. This cmdlet does not cut or delete the items being copied. Copy-Item can copy files and directories in a filesystem drive and registry keys and entries in the registry drive.
You are the administrator for a large hospital. You have dozens of doctors who are affili- ated with the hospital but do not have offices within the hospital. You have been asked to install a domain controller in a small doctor’s office that is offsite. The doctor’s office does not have a secure server room. What is the best way to complete this task?
A. Do not install a domain controller at their location. Install a Windows Server 2016 Server Core server and enable Universal Group Membership Caching on that server.
B. Install a domain controller at their office and enable certificates.
C. Make the new server a Windows Server 2016 Server Core system and install the
domain controller as a Read-Only Domain Controller (RODC) server.
D. All of the above.
C. By making the server a Server Core based server, you prevent users from changing the Windows Server by using the graphical user interface (GUI). Server Core has no GUI installed on it. Then by making the domain controller an RODC, you prevent changes to Active Directory.
You are the administrator for your company network. You and a colleague are discussing changing an existing partition’s filesystem to another filesystem. What command-line util- ity should you use? A. CHANGE B. CONVERT C. REVERT D. TRANSFORM
B. If you want to convert an existing partition from one filesystem to another, you will need to use the CONVERT command-line utility. For example, to convert the C: partition from FAT to NTFS, you would use the following command: CONVERT c: /fs:ntfs.
You are the administrator for your company network. Your network contains an Active Directory domain. All the accounts of the users in the Marketing department are in an organizational unit (OU) named MarketingOU. An application named App1 is deployed to the user accounts in MarketingOU by using a Group Policy Object (GPO) named MarketingGPO. What should you do if you need to set the registry value of \HKEY_CURRENT_USER\Software\App1\Collaboration to 0? (Choose all that apply.)
A. Add a user preference that has an Update action.
B. Add a user preference that has a Replace action.
C. Add a user preference that has a Create action.
D. Add a user preference that has a Delete action.
A, B. The Update action will, if a drive mapping exists, be updated with the settings speci- fied. The Replace action will remove whatever drive mapping exists for this share and cre- ate a new one with these settings.
You are the administrator for your company network. You and a colleague are discussing installing additional domain controllers by using the Install from Media (IFM) installation method. What is the name of the utility that allows you to create installation media for the creation of an additional domain controller in the domain? A. dcdiag.exe B. netdom.exe C. ntdsutil.exe D. repadmin.exe
C. Windows Server 2016 allows you to install a domain controller using the IFM method by using the Ntdsutil utility. The Ntdsutil utility allows you to create installation media for an additional domain controller in a domain.
You are the administrator for your company network. You and a colleague are discussing trusts. What kind of trust is set up between one domain and another domain in the same forest? A. Domain trust B. External trust C. Forest trust D. Shortcut trust
D. Shortcut trusts are trusts that are set up between two domains in the same forest. Short- cut trusts are one-way or two-way transitive trusts that can be used when administrators need to optimize the authentication process
