Your network contains an Active Directory forest that contains three domains.
A group named Group1 is configured as a domain local distribution group in the forest root
domain.
You plan to grant Group1 read-only access to a shared folder named Share1.Share1 is
located in a child domain.
You need to ensure that the members of Group1 can access Share1.
What should you do first?
A.
Convert Group1 to a universal security group.
B.
Convert Group1 to a global distribution group.
C.
Convert Group1 to a universal distribution group.
D.
Convert Group1 to a domain local security group.
Explanation:
Universal can be used for any domain or forest. Furthermore a Universal group can span
multiple domains, even the entire forest.
References:
Exam Ref 70-410: Installing and Configuring Windows Server 2012 R2: Chapter 5: Install
and Administer Active Directory, Objective 5.3 Create and manage Active Directory groups
and Organization units, p. 289-291, 293
http://technet.microsoft.com/en-us/library/cc781446(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/cc755692(v=ws.10).aspx
Answer B (Global Distribution group) sounds better.
Question stated there is one Forest and three Domains.
Global Groups can be assigned permissions to any Domain in the same Forest.
Universal Security Group would ‘only’ be correct if you were spanning multiple Forests.
http://technet.microsoft.com/en-us/library/cc755692%28v=ws.10%29.aspx
0
0
Dude, how the hell do you assign permissions to a distribution group? Answer = You don’t. You can only assign permissions to a security group, hence you’re wrong.
A is correct.
0
0
yup
0
0
your logic would be correct if it were a global security group
0
0
A distribution group is mainly for creating email DLs. For assigning permissions you always need a security group hence A
0
0
I agree with Monu, You can’t assign permission to a distribution group. Correct answer is A
0
0
exactly, you can assign permission to security group not distribution group (but you can assign email address to security group)
so the correct answer is A. convert to universal security group
0
0
Why not D? Since its a child domain
0
0
bc it would be domain local 🙂
domain local to the root domain and it needs access in another domain.
universal and global security groups are the only groups that can be used to assign rights in other domains. > so A indeed.
0
0
You convert to the Universal security group. Then you can place it into a Domain Local group in the child domain…that would be Best Practices…if im not mistaken.
0
0
If Global Security Group was an option, then that would be the answer. But since it is not, the correct answer is A.
0
0
Global group is never an option since you can’t convert local groups to global. Local groups only convert to universal.
1
0
NVM, I’m wrong. Groups can’t contain other groups for conversion, but it can be done.
0
0