Your network contains an Active Directory domain named contoso.com. The domain contains a file
server named Server1. The File Server Resource Manager role service is installed on Server1. All
servers run Windows Server 2012 R2.
A Group Policy object (GPO) named GPO1 is linked to the organizational unit (OU) that contains
Server1. The following graphic shows the configured settings in GPO1.
Server1 contains a folder named Folder1. Folder1 is shared as Share1.
You attempt to configure access-denied assistance on Server1, but the Enable access-denied
assistance option cannot be selected from File Server Resource Manager.
You need to ensure that you can configure access-denied assistance on Server1 manually by using
File Server Resource Manager.
Which two actions should you perform?
A.
Set the Enable access-denied assistance on client for all file types policy setting to Disabled for
GPO1.
B.
Set the Customize message for Access Denied errors policy setting to Not Configured for GPO1.
C.
Set the Enable access-denied assistance on client for all file types policy setting to Enabled for
GPO1.
D.
Set the Customize message for Access Denied errors policy setting to Enabled for GPO1.
Explanation:
C)
To configure access-denied assistance for all file types by using Group Policy
Open Group Policy Management. In Server Manager, click Tools, and then click Group Policy
Management.
Right-click the appropriate Group Policy, and then click Edit.
Click Computer Configuration, click Policies, click Administrative Templates, click System, and then
click Access-Denied Assistance.
Right-click Enable access-denied assistance on client for all file types, and then click Edit.
Click Enabled, and then click OK.
D)
To configure access-denied assistance by using Group Policy (see step 5)
Open Group Policy Management. In Server Manager, click Tools, and then click Group Policy
Management.
Right-click the appropriate Group Policy, and then click Edit.
Click Computer Configuration, click Policies, click Administrative Templates, click System, and then
click Access-Denied Assistance.
Right-click Customize message for Access Denied errors, and then click Edit.
Select the Enabled option.Etc
Deploy Access-Denied Assistance (Demonstration Steps)
http://technet.microsoft.com/en-us/library/hh831402.aspx
Should be BC as 412v4’s answer.
Explanation:
B: Having the ‘Customize messages for Access Denied errors’ set to Disabled as the exhibit
shows is what is causing the option to be grayed out in FSRM. By setting this to Not Configured,
you would then have the ability to MANUALLY ENABLE it in FSRM, like the question is stating
you should do.
C: ‘Enable access-denied assistance…’ needs to be set to Enabled, as it is outlined in the technet
article for configuring this feature. If you only do the first step and not this, access-denied
assistance will still not work.
2
0
Agreed. B & C
0
0
From the GPO info:
If you enable this policy setting users receive a customized Access Denied message from the file servers on which this policy setting is applied. If you disable this policy setting users see a standard Access Denied message that doesn’t provide any of the functionality controlled by this policy setting regardless of the file server configuration.If you do not configure this policy setting users see a standard Access Denied message unless the file server is configured to display the customized Access Denied message. By default users see the standard Access Denied message.
I think its best to enabled the policy as per the answer above (C & D)
0
0
I think C&D is correct, because these settings are in the PREFERENCES. Preferences are persistent, so changing the Customized Access Denied message back to Not Configured will not undo the actual setting. Once set, the only way to change this is to adjust the setting in Group Policies.
0
0
https://technet.microsoft.com/en-us/library/hh831402.aspx
They are not the PREFERENCES, don’t push people from track. It is administrative templatem, so for be able to change this setting MANUALY you MUST set first setting as NOT CONFIGURED.
0
0
Mina, you are totally right.
0
0
tested in lab, B&C . Mina was right. The description was ambiguous, please think in this was, if you enabled the setting in GPO. The customized message was configured in GPO and this setting apply to the file server, it was managed from GPO setting.
0
0
I think the right answer is cleared up so far…
BUT there’s still some WTF aspect left IMHO:
did anyone notice that the “Enable access-denied assistance on client…” setting is a CLIENT setting? It does not have any impact to the task we are asked for!
So if both settings are activated in a single GPO and you want the client computers to receive it, then you have to consider either additional GPO links to establish or that the client computers are also located in the same OU as the server.
To just accomplish mission (= configure the server manually!) only one single option would do (B)! What we have here is to choose just an additional (but useless) option without any impact when it comes to follow the strict wording of the question…
somewhat mindf*cking aspect!
0
0
C and D are correct.
You can configure Administrative Template policy settings to one of three states: Not Configured , Enabled , and Disabled .
Not Configured is the default state for all policy settings. Policy settings set to Not Configured do not affect users or computers.
Enabling an Administrative Template policy setting activates the policy setting. When Enabled , the action described in the title of the policy setting applies to the user or computer.
https://www.exam-labs.com/exam/70-411 (VERY HELPFUL!!) (Checkout the answer to question 1)
0
0
Not configured allows it to be manually created through FSRM, exactly like what the question is asking us to do.
0
0
Tested, answers are indeed B&C.
I first disabled policy setting “Customize message for access denied error”.
I was not able to enable “Enable access-denied assistance”.
After I set policy setting “Customize message for access denied error” to “Not configured”, I was able again to enable “Enable access-denied assistance”.
0
0