Your network contains an Active Directory domain named contoso.com. All user accounts are in an
organizational unit (OU) named Employees.
You create a Group Policy object (GPO) named GP1. You link GP1 to the Employees CU.
You need to ensure that GP1 does not App1y to the members of a group named Managers.
What should you configure?
A.
The Security settings of Employees
B.
The WMI filter for GP1
C.
The Block Inheritance option for Employees
D.
The Security settings of GP1
Explanation:
A: Wrong Group
B: Windows Management Instrumentation (WMI) filtersallow you to dynamically determine the scope of
GroupPolicy objects (GPOs) based on attributes of the target computer.
C: Blocking inheritance prevents Group Policy objects (GPOs) that are linked to higher sites, domains,
ororganizational units from being automatically inherited by the child-level. D: Set Managers to – Members of
this security group are exempt from this Group Policy object.
Security settings.Youuse the Security Settings extension to set security options for computers and userswithin
the scope of a Group Policy object. You can define local computer, domain, and network securitysettings.
Figure belows shows an example of the security settings that allow everyone to be affected by this GPO
exceptthe members of the Management group, who wereexplicitly denied permission to the GPO by settingthe
App1yGroup Policy ACE to Deny. Note that if a
member of the Management group were also a member of a groupthat had an explicit Allow setting for the
App1y Group Policy ACE, the Deny would take precedence and theGPO would not affect the user.
http://technet.microsoft.com/en-us/library/bb742376.aspx http://technet.microsoft.com/en-us/library/cc786636
(WS.10).aspx http://technet.microsoft.com/en-us/library/cc731076.aspx http://technet.microsoft.com/en-us/
library/cc779036(v=ws.10).aspx
