DRAG DROP
Your network contains an Active Directory domain named contoso.com. All domain controllers run
Windows Server 2012.
The domain contains an organizational unit (OU) named OU1. OU1 contains an OU named OU2. OU2
contains a user named User1.
User1 is the member of a group named Group1. Group1 is in the Users container.
You create five Group Policy objects (GPO). The GPOs are configured as shown in the following table.
The Authenticated Users group is assigned the default permissions to all of the GPOs.
There are no site-level GPOs.
You need to identify which three GPOs will be applied to User1 and in which order the GPOs will be
applied to User1.
Which three GPOs should you identify in sequence?
To answer, move the appropriate three GPOs from the list of GPOs to the answer area and arrange
them in the correct order.
Answer: See the explanation
Explanation:
Box 1: GPO1
Box 2: GPO3
Box 3: GPO5
Note:
* Box 1: Domain GPOs are applied before OU GPOs.
Not when enforce is enabled.
0
0
This is only partially correct. The order of processing of GPOs is local, site, domain and OU. GPOs linked to OUs that have a computer or user assigned directly (in this example OU2 with User1) are processed before enforced GPOs are applied.
In the table, the enforced GPOs have additional permissions: Denied Read and Denied Apply for Group1, that User1 is a member of, so they are not applied.
0
0
Answer is correct
1
0
Remember LSDOU!!!!!
GPOs are processed in the following order:
• The local GPO is applied.
• GPOs linked to sites are applied.
• GPOs linked to domains are applied.
• GPOs linked to organizational units are applied. For nested organizational units, GPOs linked to parent organizational units are applied before GPOs linked to child organizational units are applied.
Note The order in which GPOs are processed is significant because when policy is applied, it overwrites policy that was applied earlier.
0
0
If enforced is enabled then the process is reversed to UODSL but as none of the enforced GPOs are applicable to User1 (Group1) this can be ignored in this question but remember it for other GPO order questions.
1
0