Your network contains an Active Directory domain named contoso.com.
You have a Group Policy object (GPO) named GPO1 that contains several user settings. GPO1 is
linked to an organizational unit (OU) named OU1.
The help desk reports that GPO1 applies to only some of the users in OU1.
You open Group Policy Management as shown in the exhibit. (Click the Exhibit button.)
You need to configure GPO1 to apply to all of the users in OU1.
What should you do?
A.
Modify the Security settings of GPO1.
B.
Disable Block Inheritance on OU1.
C.
Modify the GPO status of GPO1.
D.
Enforce GPO1.
Explanation:
Inheritance is blocked, but that would only affect policies applied ABOVE the given OU, not the one
applied directly to it (as is the case with GPO1). Also Enforcing a policy is only going to cause it to be
applied even when inheritance is blocked (which, as mentioned, does not make a difference on
policies which are directly linked to the OU as a child). That means that there must be something in
the security settings (such as a Security Group which does not have the “read” or “Apply group
policy” permission) preventing ALL of the users in OU1 from having the policy applied. (GPO status is
the status of its replication within the forest, so it is not relevant here.)
I think it is D
0
0
You do not need to enforce the GPO, because it is linked to OU1.
0
0
After some looking up I stick with the original answer for these reasons:
A: could be the case.. see below.
B: This seems to be at best have no effect or at worst a contrary effect.
C: The GPO is linked hence working. A status change will only make it not working.
D: The GPO seems to be the only one in the ou, hence enforcing it is pointless. Enforcing means it will be effective even when it is blocked or other GPO’s apply. But neither is the case.
This leaves me with A. It could be that in Delegation the users in question are part of a group that has no rights to the GPO.
Think the question is too vague to resemble real life experiences. Usually, you check for which users the GPO works on and for which not and then you figure out what these have in common. If the question had stated: users in group a are affected and those in group b are not, that it would be much more to real life. But guess that would make it too obvious.
0
0
@Arno Lutter
I agree with you…. seems that there may be a security issue in the delegation tab
0
0