70-217 - Deja's Thur 70-217 Question of the Day

Author

Deja's Thur 70-217 Question of the Day

Deja-vue

2002-12-19, 12:49 am

Toughie for today!
Cyperdude, please do not jump right in, please, wait up for some relies...
Thanks!
After a few posts, you may hit 'em!

You are the administrator of your company's network, which consists of one Windows 2000 domain. There is a single top-level OU named Main and five child OUs. The child OUs are named after the company's five departments:

Finance
Marketing
Sales
HR
IT

The accounts for all users and computers in each department are defined in the OU for that department. All users and computers in the Finance, Marketing, Sales and HR OUs require the same desktop settings. Users and computers in the IT OU require less restrictive settings.

You want to accomplish the following goals:

All the assigned Group Policy settings are defined by the administrator in the Main OU will be applied to all users and computers in the Finance, Marketing, Sales, and HR OUs.
Group Policy from the Main OU will not be applied to the IT OU.
Administrators in the IT OU will be able to change the Group Policy settings.
When new child OUs are added to the domain, the Group Policy will be applied to them automatically.
Users will not be able to change their Group Policy settings.

You take the following actions:

- Create the GPO, configure the appropriate settings, and link the GPO to the Main OU.
- In the Group Policy Options dialog box for the Main OU, select the No Override check box.
- In the Group Policy dialog box for the IT OU, select the Block Policy inheritance check box.
- Assign the Authenticated Users group Full Control permission to the GPO.

Which results do these actions produce?

A. All the assigned Group Policy settings as defined by the administrator in the Main OU are applied to all users and computers in the Finance, Marketing, Sales, and HR OUs.

B. Group Policy from the Main OU will not be applied to the IT OU.

C. Administrators in the IT OU are able to change the Group Policy settings.

D. When new child OUs are added to the domain, the Group Policy is applied to them automatically.

E. Users cannot change their Group Policy settings.

We'll see ya' tomorrow with the correct Answers .

gonza55

2002-12-19, 6:13 am

I think that the answer is: A, C and D

Salu2

B4yaman3

2002-12-19, 9:40 pm

I am going with A B C D.

But that scenario should never be the case..
I think it should be this..>>

1. Create a policy that contains the common functionality and permissions...apply that to the domain at large..
2.Create a policy fer each child OU that only defines the special features of that OU...
3.Inherit from upper levels whenever possible...

4.IF IT has features that r incompatible with the domain policy then that policy, and that one alone, shud not inherit from the domain.
But it should export policy information for each of its child objects

Deja-vue

2002-12-19, 9:44 pm

quote:
Originally posted by Deja-vue
Toughie for today!
Cyperdude, please do not jump right in, please, wait up for some relies...
Thanks!
After a few posts, you may hit 'em!

You are the administrator of your company's network, which consists of one Windows 2000 domain. There is a single top-level OU named Main and five child OUs. The child OUs are named after the company's five departments:

Finance
Marketing
Sales
HR
IT

The accounts for all users and computers in each department are defined in the OU for that department. All users and computers in the Finance, Marketing, Sales and HR OUs require the same desktop settings. Users and computers in the IT OU require less restrictive settings.

You want to accomplish the following goals:

All the assigned Group Policy settings are defined by the administrator in the Main OU will be applied to all users and computers in the Finance, Marketing, Sales, and HR OUs.
Group Policy from the Main OU will not be applied to the IT OU.
Administrators in the IT OU will be able to change the Group Policy settings.
When new child OUs are added to the domain, the Group Policy will be applied to them automatically.
Users will not be able to change their Group Policy settings.

You take the following actions:

- Create the GPO, configure the appropriate settings, and link the GPO to the Main OU.
- In the Group Policy Options dialog box for the Main OU, select the No Override check box.
- In the Group Policy dialog box for the IT OU, select the Block Policy inheritance check box.
- Assign the Authenticated Users group Full Control permission to the GPO.

Which results do these actions produce?

A. All the assigned Group Policy settings as defined by the administrator in the Main OU are applied to all users and computers in the Finance, Marketing, Sales, and HR OUs.

B. Group Policy from the Main OU will not be applied to the IT OU.

C. Administrators in the IT OU are able to change the Group Policy settings.

D. When new child OUs are added to the domain, the Group Policy is applied to them automatically.

E. Users cannot change their Group Policy settings.

We'll see ya' tomorrow with the correct Answers .

Gonza was right! Answer A-C-D was correct!
Full Control to the GPO is given to Authenticated Users so "Admins in the IT OU can change GPO settings" is met. As a matter of fact, any authenticated user will be able to change their GPO settings. It's a top-level OU with "No Override" so it will be applied to the lower-level OUs and new child OUs.
GPOs can be applied to sites, DOMAINS and OUs. If more then one GPO is in effect, then the GPO nearest to that object is applied. If "no override" is used, then the GPOs settings is given higher priority than other GPOs that don't have "no override" configured. If 2 GPOs conflict and both have "no override" set, then the GPO closest to the container applies. In this scenario, within one domain the top-level OU has "No Override". This should have higher priority over the "block policy inheritance" of the IT OU, therefore the requirement "GPO from Main OU will NOT be applied to IT OU" is NOT met.

Sponsored Links