Your network contains an Active Directory domain named contoso.com. All domain
controllers run Windows Server 2012 R2.
The domain contains 200 Group Policy objects (GPOs).
An administrator named Admin1 must be able to add new WMI filters from the Group Policy
Management Console (GPMC).
You need to delegate the required permissions to Admin1. The solution must minimize the
number of permissions assigned to Admin1.
What should you do?
A.
From Active Directory Users and Computers, add Admin1 to the
WinRMRemoteWMIUsers__group.
B.
From Group Policy Management, assign Creator Owner to Admin1 for the WMI Filters
container.
C.
From Active Directory Users and Computers, add Admin1 to the Domain Admins group.
D.
From Group Policy Management, assign Full control to Admin1 for the WMI Filters
container.
Explanation:
Users with Full control permissions can create and control all WMI filters in the domain,
including WMI filters created by others.
Users with Creator owner permissions can create WMI filters, but can only control WMI
filters that they create.
Ref: http://technet.microsoft.com/en-us/library/cc757429(v=ws.10).aspx
The question is about ability to add “new WMI filters” so the answer is B.
0
0
i thinks like John B
0
0
it doesn’t say whether the new WMI filter would be created by Admin1 or someone else.
I assume its the former, so B is the answer
0
0
‘New’ in this context can only mean newly created by Admin1. If created by a different user, then it is no longer new as it will already be in existence (just like other filters) once created before Admin1 user touches it.
0
0
Yep the correct answer is B
0
0
Delegating creation of WMI filters
The ability to create WMI filters is a per-domain right. In GPMC, there are two levels of permission for creating WMI filters. Creator Owner allows the user to create new WMI Filters in the domain, but does not grant them permissions on WMI filters created by other users. Full Control allows the user to create WMI filters, and grants them full control on all WMI Filters in the domain, including new filters that are created after they are granted this right.
https://technet.microsoft.com/en-us/library/cc776858%28v=ws.10%29.aspx
0
0
B. Creator Owners can create their own WMI filters. Question is only concerned with ADDING so this is the least amount of permissions granted.
0
0
B:
Users with Full control permissions can create and control all WMI filters in the domain, including WMI filters created by others. Users with Creator owner permissions can create WMI filters, but can only control WMI filters that they create.
https://technet.microsoft.com/en-us/library/cc757429%28v=ws.10%29.aspx
0
0
You are correct the key words in this question: “must be able to ADD NEW” so FullControl is not needed.
0
0
The answer is option “D”, as we can delegate the ability to create and manage WMI filters through GPMC or the Delegation of Control Wizard in Active Directory Users and Computers.
0
0
Sorry, i had to say the answer as option “B”, when we delegate full control then user (admin1) will be able to create WMI filters and manage them as well, i.e. admin1 will be able to manipulate the WMI filters created by other users, which is not the requirement and that way we are not limiting the number permissions to admin1, which is the requirement. The requirement is that admin1 should only be able to create new WMI filters not to manage them. The correct answer should be option “B”.
0
0
I think we can all agree that D is wrong and B is the correct answer,i was surprised when my VCE pointed to D ass well,you really need to double check some of these question and i’m glad this site exists 🙂
0
0
Be wary, there is another variation of the question that states:
An administrator named Admin1 must be able to create new WMI filters and edit all of the existing WMI filters from the Group Policy Management Console (GPMC).
In this case it’s D.
0
0
Yeah true be careful guys
Thanks Jobby!
0
0