You have a single Active Directory directory service domain. You have a certification authority (CA) that runs on Windows Server 2003. Your company requires users to log on to their portable computers with two-factor authentication. You need to prepare your CA for two-factor authentication. Which certificate template should you publish on the CA?

You have a single Active Directory directory service domain. All domain controllers run Windows Server 2003. You are configuring a software restriction policy. You need to allow users to run only a defined set of executables. What should you do?

You have a single Active Directory directory service domain. You need to grant a user the following permissions:To create Group Policy objects (GPOs) in the domainTo modify all existing and new GPOs in the domainYou add the users user account to the Group Policy Creator Owners group. What should you do next?

You have a single Active Directory directory service domain. All client computers run either Windows Vista or Windows XP. You create and configure a Group Policy object (GPO) named Secure Client Computer. You need to ensure that the Secure Client Computer GPO is automatically applied to current and future Windows XP client computers. What should you do?

You are the network administrator for your company. The network consists of a single Active Directory domain. All servers run Windows Server 2003. All client computers run Windows XP Professional and are members of the domain. Only designated IT support staff have administrative rights on client computers. The company requires all client computers to run antivirus software. The company licenses an antivirus application that is installed on a file server named Server1. An unattended installation can be performed on each client computer by running the setup command from a shared folder on Server1. Several users report that when they attempt to install the antivirus application, they receive the following error message: “You do not have sufficient privileges on this computer to perform this action.” You verify that the antivirus application is not installed on any client computers. You need to ensure that all client computers have the antivirus application installed. You want to accomplish this task by using the minimum amount of administrative effort. What should you do?

Your network consists of Windows XP computers joined to an Active Directory directory service domain. All users are located in a single organizational unit (OU). Several Group Policy objects (GPOs) are linked to this OU. A new GPO is created and must be linked to the OU. You need to ensure that the new GPO settings take precedence over settings from other GPOs. What should you do?

You have a Windows Server 2003 Active Directory directory service environment that contains an organizational unit (OU) named Corp. All computers and users are located in the Corp OU. An existing Group Policy object (GPO) named HR is linked to the Corp OU. You deploy a new GPO named Software to the Corp OU. A global group named Corp Users contains all users and has the Read and the Apply Group Policy permissions for the Software GPO and to the Corp OU. You need to ensure that the settings in the Software GPO are applied to all users except one specific user. The settings in the HR GPO must continue to be applied to all users. What should you do?

You have a single Active Directory directory service domain. All domain controllers run Windows Server 2003. You need to use Group Policy to audit when domain controllers are restarted. How should you modify the Default Domain Policy?

You have a single Active Directory directory service domain with an enterprise certification authority (CA). You are creating a new Group Policy object (GPO) to perform certificate autoenrollment. You need to ensure that users are notified when an autoenrollment failure occurs. What should you do?

Your company has a single Active Directory directory service forest with three domains. A site named Site1 has three domain controllers named DC1, DC2, and DC3. All three domain controllers have the same directory and application partitions. DC3 holds the PDC Emulator Master and RID Master roles. You need to prevent DC3 from performing intersite replication, and you must accomplish this goal without disrupting intrasite replication. What should you do?