You have a single Active Directory directory service domain. You need to grant a user the following permissions:To create Group Policy objects (GPOs) in the domainTo modify all existing and new GPOs in the domainYou add the users user account to the Group Policy Creator Owners group. What should you do next?

You have a single Active Directory directory service domain. All client computers run either Windows Vista or Windows XP. You create and configure a Group Policy object (GPO) named Secure Client Computer. You need to ensure that the Secure Client Computer GPO is automatically applied to current and future Windows XP client computers. What should you do?

Your network consists of Windows XP computers joined to an Active Directory directory service domain. All users are located in a single organizational unit (OU). Several Group Policy objects (GPOs) are linked to this OU. A new GPO is created and must be linked to the OU. You need to ensure that the new GPO settings take precedence over settings from other GPOs. What should you do?

You have a Windows Server 2003 Active Directory directory service environment that contains an organizational unit (OU) named Corp. All computers and users are located in the Corp OU. An existing Group Policy object (GPO) named HR is linked to the Corp OU. You deploy a new GPO named Software to the Corp OU. A global group named Corp Users contains all users and has the Read and the Apply Group Policy permissions for the Software GPO and to the Corp OU. You need to ensure that the settings in the Software GPO are applied to all users except one specific user. The settings in the HR GPO must continue to be applied to all users. What should you do?

You have a single Active Directory directory service domain with an enterprise certification authority (CA). You are creating a new Group Policy object (GPO) to perform certificate autoenrollment. You need to ensure that users are notified when an autoenrollment failure occurs. What should you do?

Your company has a single Active Directory directory service forest with three domains. A site named Site1 has three domain controllers named DC1, DC2, and DC3. All three domain controllers have the same directory and application partitions. DC3 holds the PDC Emulator Master and RID Master roles. You need to prevent DC3 from performing intersite replication, and you must accomplish this goal without disrupting intrasite replication. What should you do?

You have a single Active Directory directory service domain with two domain controllers named DC1 and DC2. DC1 and DC2 are located in two Active Directory sites. Both domain controllers run Windows Server 2003 and are configured as global catalog servers. A domain user object is deleted on DC1. Replication has not yet occurred between DC1 and DC2. You need to recover the deleted object before the change is replicated to DC2. What should you do first?

You have a single Active Directory directory service domain with three domain controllers named DC1, DC2, and DC3. All FSMO roles are held on DC1. All domain controllers are global catalog servers. Several users are experiencing logon times that are longer than normal. All users are authenticating with DC1 and DC3. The DC2 logs display error messages indicating that the Active Directory database partition is out of free space. You need to ensure that Active Directory is accessible on DC2. You add a 500-GB hard disk to DC2, back up the system state data, and restart DC2 in Directory Services Restore Mode. What should you do next?