Final Flashcards
T/F An organizational unit is a logical subgroup within Active Directory that you can
employ to locate resources used by a single workgroup, section, or department in a
company and apply policies that apply to only these resources.
True—An easily managed OU structure reflects some aspects of your company’s
internal organization.
T/F The main purpose of a security group is to create a distribution list for email
purposes. These groups have security information, such as unique security identifiers
(SIDs).
False—A distribution group is used to create a distribution list. These groups do
not possess SIDs and cannot be assigned permission to resources
T/F When you assign a single user or group full control of the entire domain, of a single
OU, or limited rights to a set of OUs, the permissions are not inheritable.
False—When you delegate control, the default behavior of AD DS is to make
such permissions inheritable.
T/F Account operators, server operators, print operators, and backup operators are built-in
security groups that enable members to perform limited administrative capabilities
within the domain in which they are located.
True—AD DS provides several built-in security groups. You can add members to
these groups when their defined rights match the administrative capabilities you
want to confer to these users.
T/F Some machine-local groups are similar in usage and membership to domain local
groups. These types of local groups do not exist in AD DS and grant users access to
resources on the local computer only.
True–For access to resources located on more than one computer in the domain,
always use domain local groups.
T/F To create an OU, you must be a member of the Account Operators group.
False–To create an OU, you must be a member of the Account Operators,
Domain Admins, or Enterprise Admins groups by default.
T/F There is a GUI version of the Active Directory Recycle Bin feature. By default, the
Recycle Bin is disabled, but you can enable it from within AD Administrative Center.
After the recycle bin is enabled, you cannot disable it.
True– When enabled, you have the ability to restore recently deleted items from
Active Directory.
T/F You have the capability to assign a single user or group full control of the entire
domain, of a single OU, or limited rights to a set of OUs.
True–When you delegate control, keep in mind that the default behavior of AD
DS is to make such permissions inheritable.
T/F If you run the Delegation of Control Wizard multiple times, permissions granted for
the OU are replaced each time with the new permissions.
False—Permissions are cumulative rather than having the wizard replace prior
permissions each time you run it.
T/F In Active Directory Users and Computers to view the effective OU permissions
granted to a user or group, the Effective Permissions tab shows all granted
permissions, including inherited permissions.
True–This includes all permissions inherited through membership in other
Groups.
Which of the following is not one of the three types of user accounts present in an AD
DS network?
Enterprise user accounts
User accounts embody specific information pertinent to a user, such
as username, password, and specific logon limitations. User accounts can be
either built-in accounts or self-generated. Each user account has a comprehensive
set of configurable properties associated with it. Among these are group
memberships, logon scripts, logon hours, account expiration, user profile, and
dial-in permission.
Which Windows Server 2012 R2 group scope can be used to include users, computers,
and groups from any domain in the forest but cannot be employed to grant permissions to
any resource in the forest?
Domain local
Domain local groups can include users, computers, and groups from
any domain in the forest. They are most often utilized to grant permissions for
resources and can be used to provide access to any resource in the domain in
which they are located. It is thus logical for a domain local group to include
global groups that contain all users with a common need for a given resource.
You can organize your domain into logical subgroups called ________that enable you
to collect users, computers, and other resources for simplified local administration
according to your company’s organizational chart of departments, sections, work units,
and so on.
Organizational units
You can change this grouping of OUs easily if your company
reorganizes; such a task is much easier than attempting to re-create child domains
according to a new corporate structure.
A(n) _______ is used to collect a set of users who need to share a particular set of
permissions to a resource, such as a file, folder, or printer.
Group
. The available membership depends on the group scope.
A recommended group nesting strategy is ________________.
None of the above
Microsoft continues to recommend the same strategy for nesting
groups that it has supported since Windows NT 4.0. Place accounts (A) into
global groups (G). Add the global groups to domain local groups (DL). Assign
permissions (P) to the domain local groups. In short, this strategy is known as
AGDLP (Accounts to Global groups to Domain Local groups to Permissions).
Which of these is a built-in security group designed to enable members to perform
limited administrative tasks within the domain in which they are located?
Backup operators
AD DS provides several built-in security groups that enable members
to perform limited administrative capabilities within the domain in which they are
located. These include account operators, server operators, print operators, and
backup operators. You can add members to these groups when their defined rights
match the administrative capabilities you want to confer to these users.
A ________ group can include users and groups from any domain in the AD DS forest
and can be employed to grant permissions to any resource in the forest.
universal.
A universal group can include users, computers, and global groups
from any domain in the forest.
The Window Server 2012 R2 security group that is granted full rights to manage the
entire domain is the ________ group.
Domain Admins.
This group is automatically made a member of each member
server’s, member computer’s, and domain controller’s Administrators local groups
The Windows Server 2012 R2 security group that has full rights to manage the domain
controllers but not the entire domain is the ________group.
Administrators
This group is in the Built-in container
The group scope that can include users, computers, and other global groups from the
same domain is ________.
universal.
You can use universal groups to organize users who have similar
functions and therefore similar requirements on the network.
Windows Server 2012 R2 includes the ________ feature, which provides guaranteed
message delivery, efficient routing, security, and priority-based messaging between
applications, including those that run on different operating systems.
Message Queuing.
You can install Message Queuing from the Add Roles and
Features Wizard in Server Manager.
In determining a nesting strategy in a ________-domain forest, you do not need to use
universal groups.
single.
Use the AGDLP strategy only with a single-domain forest.
The command-line command to add an OU to your domain would begin with
________.
dsadd.
In addition to the traditional tools, Windows Server 2012 R2 enables
you to perform this task from the Active Directory Administrative Center.
The __________ Wizard enables you to delegate administrative tasks.
Delegation of Control.
You access the wizard either through Active Directory
Users and Computers or Active Directory Administrative Center.
Domain local group
Can include users, computers, and groups from any domain in the forest but cannot be
employed to grant permissions to any resource in the forest
Global group
Can contain users from the same domain in which the global group is located, and
global groups can be added to domain local groups to control access to network resources
Universal group
Security group that can be used anywhere within a domain tree or forest
AGDLP
Recommended group nesting strategy when universal groups are not involved
Built-in group
Created by default when Windows or Active Directory is installed on a computer
AGUDLP
Nesting strategy involving universal groups
Nesting
Act of creating a hierarchy of groups to provide users from different containers
(domains, OUs, and so on) access to the resources they require for their jobs
Active Directory Administrative Center
Snap-in in Windows Server 2012 R2 that enables the administration of most Active
Directory functions from a single console
Security groups
Used to assign rights and permissions, and which have a SID
Distribution groups
Used for functions such as email, and which do not have SIDs
T/F Group Policy is a set of configuration settings that can be applied to one or more
Active Directory Domain Services (AD DS) objects to define the behavior of the
object and its child objects
True—Group Policy is a set of configuration settings that can be applied to one
or more Active Directory Domain Services (AD DS) objects to define the
behavior of the object and its child objects.
T/F The GPMC is installed when you install AD DS.
True—You can also install the GPMC on a member server by accessing the Add
Features Wizard in Server Manager. GPMC is also included in the Remote Server
Administration Tools package, which you can install on a client computer running
Windows 8.1 Pro or higher.
T/F The Block Policy setting enables you to prevent GPOs that are linked to parent
containers from being applied at the lower level.
False—The Block Inheritance setting accomplishes this. A situation in which this
might be useful is where the administrator of an OU wants to control all GPOs
that apply to computers or users in the OU without inheriting settings from the
site or parent domain.
T/F All Group Policy Objects are identified by their PolicyIDs.
False—Group Policy Objects are identified by their GUIDS. A GUID is a unique
128-bit number assigned when the GPO is first created. This number is stored as
an attribute of the object and is used to identify it within the AD DS.
T/F Group Policy Management Console is included by default with Windows Server 2012
R2 and is the sole location for managing all aspects of Group Policy.
True—You perform all Group Policy administrative activities, including creating,
editing, and applying GPOs from the GPMC.
T/F Group Policy Templates are objects that are defined within AD DS and are used to
store the properties of GPOs, including attributes and version information.
False—This describes Group Policy Containers, which contain subcontainers for
user and computer Group Policy data. Information as to whether the GPO is
enabled or disabled is also stored here. Being stored in AD DS, computers can
access GPCs to locate GPTs, and domain controllers can access them to obtain
version information, which verifies that they have the most recent edition of
GPOs. .
T/F The Administrative Templates subcontainer is found under both the Computer and
User Configuration Policies containers and holds most of the settings that control the
appearance of the desktop environment.
True— There is an All Settings subnode that provides a comprehensive list of all
policy settings that you can sort according to name, state, comment, or path, or
filter according to several criteria.
T/F The folder hierarchy composed of the Group Policy Containers folder at the top and
subfolders under it holds all the information for a given GPO.
False—This describes the Group Policy Templates folder.
T/F Group Policy Containers are sets of Group Policies.
False—A Group Policy Object is a set of Group Policies.
T/F Computer policies are computer-specific and are applied when the computer starts up,
and user policies are user-specific and are applied when the user logs on to the
computer.
True— Group Policy can be applied to server and client computers running
Windows 2000 and up and includes both computer and user settings.
Group policy is a group of policies that are applied together. It is a set of
configuration settings that can be applied to one or more Active Directory Domain
Services (AD DS) objects to define the behavior of the object and its
______________.
Child objects
The policies are contained in sets known as Group Policy objects
(GPOs). In turn, the content of GPOs is stored in two different locations: Group
Policy containers (GPCs), which are Directory Services objects that include
subcontainers for machine and user Group Policy information, and Group Policy
templates (GPTs), which are folder structures including a GPT folder and its
subfolders that together contain all the Group Policy information including the
actual policy settings for any particular GPO.
All GPOs are identified by their ________.
Globally Unique Identifier (GUID)
A GUID is a unique 128-bit number assigned when the GPO is first
created. This number is stored as an attribute of the object and is used to identify
it within the AD DS.
Group Policy __________are objects that are defined within AD DS and are used to
store the properties of GPOs, including attributes and version information.
Containers
Group Policy Containers contain subcontainers for user and computer
Group Policy data. Information as to whether the GPO is enabled or disabled is
also stored here. Being stored in AD DS, computers can access GPCs to locate
GPTs, and domain controllers can access them to obtain version information,
which verifies that they have the most recent edition of GPOs.
The folder hierarchy is composed of the Group Policy __________ folder at the top
and subfolders under it. This structure holds all the information for a given GPO.
Templates
Every domain has associated with it a folder hierarchy found in the
domain controllers at the shared folder
%systemroot%\SYSVOL\sysvol\Policies.
________ is the sole location for managing all aspects of Group Policy.
Group Policy Management Console
You perform all Group Policy administrative activities, including
creating, editing, and applying GPOs from the GPMC.
The subcontainer found under both the Computer and User Configuration Policies
containers that holds most of the settings that control the appearance of the desktop
environment is called ___________.
Administrative templates
There is an All Settings subnode that provides a comprehensive list of
all policy settings that you can sort according to name, state, comment, or path, or
filter according to several criteria.
The subcontainer found under both the subcontainer found under both the Computer
and User Configuration Policies and Preferences containers that holds script and
security settings is called _________.
Windows Settings
The Windows Settings subcontainer contains other policy settings that
affect the behavior of the Windows environment.
When you create a new GPO or edit an existing one, and if you have configured new
settings in the Computer Configuration node, users affected by the GPO must
_______.
Reboot their computers
If you have configured new settings in the Computer Configuration
node, users must reboot their computers to receive the new settings
When you create a new GPO or edit an existing one, users affected by the GPO must
_______.
Log off and log back on again
Users need only log off and log on for new settings to apply. If you
have configured new settings in the Computer Configuration node, users must
reboot their computers to receive the new settings.
By default, only members of the Domain Admins and Group Policy Creator Owners
groups have permissions to ________.
Create GPOs
You can delegate control of Group Policy objects to users and groups
to enable partial administrative control and ease the overall burden of
administration.
It is possible to edit a GPO from any writable domain controller, or even to connect to
a writable domain controller from a client computer running ________.
Both Windows 8.1 Pro and Windows 8.1 Enterprise
When you connect, you might want to specify which domain
controller you are working against.