Your network contains one Active Directory domain named contoso.com. The forest functional level is Windows
Server 2012. All servers run Windows Server 2012 R2. All client computers run Windows 8.1.The domain contains 10 domain controllers and a read-only domain controller (RODC) named RODC01. All
domain controllers and RODCs are hosted on a Hyper-V host that runs Windows Server 2012 R2.
You need to identify which security principals are authorized to have their password cached on RODC1.
Which cmdlet should you use?
A.
Get-ADGroupMember
B.
Get-ADDomainControllerPasswordReplicationPolicy
C.
Get-ADDomainControllerPasswordReplicationPolicyUsage
D.
Get-ADDomain
E.
Get-ADOptionalFeature
F.
Get-ADAccountAuthorizationGroup
G.
Get-ADAuthenticationPolicySilo
H.
Get-ADAuthenticationPolicy
Explanation:
The Get-ADDomainControllerPasswordReplicationPolicy gets the users, computers, service accounts and
groups that are members of the applied list or denied list for a read-only domain controller’s (RODC) password
replication policy. To get the members of the applied list, specify the AppliedList parameter. To get the
members of the denied list, specify the DeniedList parameter.
Example: Get from an RODC domain controller password replication policy the allowed accounts showing the
name and object class of each:
Get-ADDomainControllerPasswordReplicationPolicy -Identity “FABRIKAM-RODC1” -Allowed | ft
Name,ObjectClass
B.Get-ADDomainControllerPasswordReplicationPolicy is correct
Get-ADDomainControllerPasswordReplicationPolicyUsage “Gets the Active Directory accounts that are authenticated by a read-only domain controller or that are in the revealed list of the domain controller.” Aka it tells you which accounts actually used the policy.
Get-ADDomainControllerPasswordReplicationPolicy “Gets the members of the allowed list or denied list of a read-only domain controller’s password replication policy.” Aka it tells you which accounts are able to or not able to use the policy.
Correct answer is definitely B
10
0