Your network contains an Active Directory forest named contoso.com. The forest contains five domains. All
domain controllers run Windows Server 2012 R2.
The contoso.com domain contains two user accounts named Admin1 and Admin2.
You need to ensure that Admin1 and Admin2 can configure hardware and services on all of the member
servers in the forest. The solution must minimize the number of privileges granted to Admin1 and Admin2.
Which built-in groups should you use?
A.
Administrators local groups
B.
Administrators domain local groups
C.
Domain Admins global groups
D.
Server Operators global groups
As only member Servers are supposed to be administered, they don´t need any privileges in the domains, but the Domain Admins as well as the global domain Administrator Group have privileges in the Domains. The same applies to members of the Server Operators Group.
So all members of the above mentioned goups could – for example – log on locally on a Domain Controller and do some or more administrative tasks there, while the local Administrators Group is only local and individual on each Server and not exisiting on Domain Controllers, but on all Member Servers.
Keep in mind, that in Microsoft´s terminology you either have a Domain Controller or a member Server, which is not a Domain Controller.
0
0