###BeginCaseStudy###
Case Study: 1
Consolidated Messenger
Scenario:
You are an enterprise desktop support technician for Consolidated Messenger.
Network Configuration
The company has three offices named Office1, Office2, and Office3. The offices connect to
each other over the Internet by using VPN connections. Each office has an 802.11g wireless
access point. All wireless access points are configured to use Radius01 for authentication.
Active Directory Configuration
The network contains one Active Directory domain named consolidatedmessenger.com. The
relevant organizational unit structure is shown in the following diagram.

The relevant Group Policy objects (GPOs) in the domain are configured as shown in the following table.

Applications
The relevant applications on the network are shown in the following table.

Server Configuration
The relevant servers are configured as shown in the following table.

Client Configuration
Each office has 500 desktop computers that run Windows 7 Enterprise. There are 250 mobile
users that travel regularly between all three offices. The mobile users have laptop computers
that run Windows 7 Enterprise. To prevent the spread of malware, the company restricts the
use of USB devices and only allows the use of approved USB storage devices.
Printers
The marketing group has several printers that are shared on File01. A shared printer name
Printer1 is a high-performance, black-and-white printer. A shared printer named Printer2 is a
high-definition, photo-quality, color printer. Printer2 should only be used to print marketing
brochures.
###EndCaseStudy###

Users in the ERPApp1 pilot project report intermittent application issues. You need to consolidate all
application events for the users in a central location. What should you do?

A.
Configure event subscriptions.

B.
Configure the Advanced Audit Policy Configuration settings.

C.
Create a custom view in Event Viewer.

D.
Create a user-defined Data Collector Set.

Explanation:
Chapter 8 Lesson 1 p 302 – 305
A) Configure event subscriptions.
Event Viewer enables you to view events on a single remote computer. However, troubleshooting an
issue might require you to examine a set of events stored in multiple logs on multiple computers.
Windows 7 includes the ability to collect copies of events from multiple remote computers and store
them locally. To specify which events to collect, you create an event subscription. Among other
details, the subscription specifies exactly which events will be collected and in which log they will be
stored locally. Once a subscription is active and events are being collected, you can view and
manipulate these forwarded events as you would any other locally stored events.
B) Configure the Advanced Audit Policy Configuration settings.
http://technet.microsoft.com/en-us/library/dd408940(WS.10).aspx
C) Create a custom view in Event Viewer.
You can create a filter that includes events from multiple event logs that satisfy specified criteria.
You can then name and save that filter as a custom view. To apply the filter associated with a saved
custom view, you navigate to the custom view in the console tree and click its name.
D) Create a user-defined Data Collector Set.
You can create a custom Data Collector Set containing performance counters and configure alert
activities based on the performance counters exceeding or dropping below limits you define.
After creating the Data Collector Set, you must configure the actions the system will take when the
alert criteria are met.
Membership in the local Performance Log Users or Administrators group, or equivalent, is the
minimum required to complete these procedures.

http://www.youtube.com/watch?v=4xxKPgT5irU
http://www.youtube.com/watch?v=fKelHBve57k