Your network contains an active directory domain named Contoso.com. The domain contains 100 user
accounts that reside in an organizational unit (OU)named OU1.
You need to ensure that user named user1 can link and unlink Group Policy Objects(GPOs) to OU1. The
solution must minimize the number of permissions assigned to user1.
What should you do?
A.
Run the Delegation of Control Wizard on the Policies containers
B.
Run the Set-GPPermissioncmdlet
C.
Run the Delegation of Control Wizard on OU1
D.
Modify the permission on the user1 account
Explanation:
A: Not minimum permissions
B: Grants a level of permissions to a security principal for one GPO or all the GPOs in a domain
C: Minimizes delegated permission to a single OU
D: Will not allow GPO changes to the OU
Delegation of Control Wizard
The following are common tasks that you can select to delegate control of them:
Create, delete, and manage user accounts
Reset user passwords and force password change at next logon Read all user information
Modify the membership of a group
Join a computer to a domain
Manage Group Policy links
Generate Resultant Set of Policy (Planning)
Generate Resultant Set of Policy (Logging)
Create, delete, and manage inetOrgPerson accounts
Reset inetOrgPerson passwords and force password change at next logon Read all inetOrgPerson information
http://technet.microsoft.com/en-us/library/dd145442.aspx http://technet.microsoft.com/en-us/library/ee461038.
aspx http://technet.microsoft.com/en-us/library/cc732524.aspx
C
0
0
Answer is B
Running the delegation wizard on the OU will affect all users in the OU.
The Set-GPPermissioncmdlet can grant a user permissions to a GPO or all GPOs.
https://technet.microsoft.com/en-us/library/Ee461038.aspx
0
0
It’s “C”
This is straight from Technet:
https://technet.microsoft.com/en-us/library/cc781991(v=ws.10).aspx
To delegate Group Policy-related permission on a site, domain, or OU, click the appropriate container in the GPMC console.
In the right pane for the site, domain, or OU, click the Delegation tab.
In the drop-down list box, select the desired permission you want to manage: Link GPOs, Perform Group Policy Modeling analyses, or Read Group Policy Results data. Note that GP Modeling and GP Results are not available for sites.
To add new groups, use the Add button.
To modify the Applies To setting for an existing permission, right-click the user or group in the list and then select either This container only or This container and all child containers.
To remove an existing group or user from having the specified permission, select the user or group from the list and click the Remove button. Only domain administrators have permission to do this.
To add or remove custom permissions, click Advanced at the bottom-right of the details pane and select the object whose permissions you want to change. Note that setting custom permissions is not recommended.
0
0