Your network contains an Active Directory forest named contoso.com. The forest contains a
single domain. The domain contains 50 domain controllers that run Windows Server 2008
R2.
The domain contains a group named Computer_Location.
You plan to create 1,000 computer accounts in the domain in several organizational units
(OUs).
You need to ensure that the members of the Computer_Location group can modify the
description of each computer account as soon as the account is created.
The solution must use permissions that are applied explicitly to the new computer accounts.
What should you do?
A.
Run the dsadd.exe command
B.Run the nltest.exe command.
C.Run the Set-AdDomain cmdlet.
D.Run the dsmove.exe command.
E.Run the dcpromo.exe command.
F.Run the Move-AdDirectoryServer cmdlet.
G.Use the Active Directory Schema snap-in.
H.Use the Active Directory Users and Computers console.
Looks like answer is H:
Normal user cannot modify the computer decription you need to delegate control to perform the same in AD i.e allow options for ‘Write Description’ on Computer object.
To grant this access, perform the following steps:
1.Open Active Directors Users and Computers MMC
2.Ensure you have ‘Advanced Features’ enabled (On the ‘view’ menu)
3.Right click on your domain, and select ‘properties’ from the context menu
4.On the ‘security’ tab, click the ‘advanced’ button
5.Click the ‘add’ button, type ‘users/group’. Then click OK.
6.In the permission entry dialogue, set the ‘apply to’ pull-down menu to ‘Descendant Computer Objects’, then in the permissions section, tick the allow options for ‘Write Description’
Reference link:http://4sysops.com/archives/automatically-fill-the-computer-description-field-in-active-directory/
0
0