Your network contains two Active Directory forests named contoso.com and
dev.contoso.com. The contoso.com forest contains a domain controller named DC1. The
dev.contoso.com forest contains a domain controller named DC2. Each domain contains an
organizational unit (OU) named OU1.
Dev.contoso.com has a Group Policy object (GPO) named GPO1. GPO1 contains 200
settings, including several settings that have network paths. GPO1 is linked to OU1.
You need to copy GPO1 from dev.contoso.com to contoso.com.
What should you do first on DC2?
A.
From the Group Policy Management console, right-click GPO1 and select Copy.
B.
Run the mtedit.exe command and specify the /Domaintcontoso.com /DC: DC 1
parameter.
C.
Run the Save-NetGpocmdlet.
D.
Run the Backup-Gpocmdlet.
Explanation:
To copy a Group Policy object:
In the GPMC console tree, right-click the GPO that you want to copy, and then click Copy.
To create a copy of the GPO in the same domain as the source GPO, right-click Group
Policy objects, click Paste, specify permissions for the new GPO in the Copy GPO box, and
then click OK .
For copy operations to another domain, you may need to specify a migration table.
The Migration Table Editor (MTE) is provided with Group Policy Management Console
(GPMC) to facilitate the editing of migration tables. Migration tables are used for copying or
importing Group Policy objects (GPOs) from one domain to another, in cases where the
GPOs include domain-specific information that must be updated during copy or import.
Source WS2008R2: Backup the existing GPOs from the GPMC, you need to ensure that the
“Group Policy Objects” container is selected for the “Backup Up All” option to be available.
Copy a Group Policy Object with the Group Policy Management Console (GPMC)
You can copy a Group Policy object (GPO) either by using the drag-and-drop method or
right-click method.
Applies To: Windows 8, Windows Server 2008 R2, Windows Server 2012
Ref: http://technet.microsoft.com/en-us/library/cc785343(v=WS.10).aspx
http://technet.microsoft.com/en-us/library/cc733107.aspx
mdedit is an Autocad command. Good to know in case you get bored from using adsiedit and want to switch jobs.
0
0
There is nothing about trust relations between the domains so my guess is Answer: D
0
0
forget about my comment, it’s a new feature with gpmc
0
0
A
https://technet.microsoft.com/en-us/library/cc733107.aspx
0
0
Deffinetly is answer: A
0
0
I agree with Tomas Answer is A
0
0
How can it be A. even in the explaination it says that the copy feature is used to copy GPO in the same domain. The question is about two different forests. I still am not sure what the answer is but it cant be A. Might be B or D.
0
0
The explanation clearly explains the method (copy) for the same domain, or different domains.
As is the case here.
0
0
but the explanation does not mention different FORESTS (was was asked), it just states different domains…
I think you are also confused by the given DNS names of the two (single domain?) forests. Nevertheless the questions asks about two different AD infrastructures (ad forests)
0
0
Many sites say D ..
0
0
I just found this : https://technet.microsoft.com/en-us/library/hh967480(v=wps.630).aspx
They don’t mention copying from domain A to domain B , they use it for backup .. and backup to a folder.
A is the only correct answer!.
0
0
B MTEDIT?
The Migration Table Editor (MTE) is provided with Group Policy Management Console (GPMC) to facilitate the editing of migration tables. Migration tables are used for copying or importing Group Policy objects (GPOs) from one domain to another, in cases where the GPOs include domain-specific information that must be updated during copy or import.
https://technet.microsoft.com/en-us/library/cc779961(v=ws.10).aspx
0
0
Alex MTEDIT reads from a existing gpo or predefined migration table, is weird but A GPO copy is the answer
0
0
Alex the link you provided above Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2 – so I would be less inclined to follow it.
0
0
A is only possible when the account that does the copy (and paste) has rights in both forests.
As there’s no mention about a trust between the 2 forests i go for backup and the import-gpo cmdlet. Especially bc the name makes it look like it is a subdomain! but in truth it are 2 seperate forests makes this another trick question from MS > D.
0
0
Both forests are of the same domain. Assume the account has the proper rights (Ent Admin). There are no issues of Trusts going on. A is correct.
0
1
What are you talking about Mark???
Forests includes domains. Domains don’t include Forests!!!
1
0
Its A
https://technet.microsoft.com/en-us/%5Clibrary/Hh967476%28v=WPS.630%29.aspx
We are talking about Win2K12R2
0
0
we are talking about 2 separate forests as the question states!
and your provided article states further “The cmdlet can be used to copy a GPO from one domain to another domain *within the same forest.*”
3
0
Nope, the link clearly states that copy can be used to a domain in another forest *if there is a trust*. There is no mention of a trust in the question (an important point when considering which option to use).
With no trust present one must use Backup and Import cmdlets.
https://technet.microsoft.com/en-us/library/cc785343(v=WS.10).aspx
So the *first* thing you must do is D.
0
0
I completely agree here. Two forests w/o a trust must be assumed, since it is not stated in the question. The answer must be D.
This Microsoft article does a very detailed explanation of doing an export-import via Powershell specifically to address separate production and test envoronments (forests).
http://blogs.technet.com/b/ashleymcglone/archive/2014/04/28/three-steps-to-migrate-group-policy-with-powershell.aspx
1
0
We prefer to honor lots of other net sites around the web, even though they arent linked to us, by linking to them. Beneath are some webpages worth checking out.
0
1
there is no information about the trust so D is the answer
0
0
The A doesn’t seem right. The question says “…including several settings that have network paths”. Simply copying the GPO will generate problems with these paths. I still don’t know if it’s D or B.
0
0
hey paolo. Please have you passed the 411 certification exam? do you still have the dump on which you prepared?? can you please please send it to me? my email is sara.ichiba.ine@gmail.com
0
0
Notice that one is the child domain of the other! So there is a trust. Answer A.
0
6