| Author |
Deja's Fri 70-217 Question of the Day
|
|
| Deja-vue 2003-01-17, 12:26 am |
| Good Friday to you all!
You are the enterprise administrator of a Windows 2000 domain. The domain is in native mode. You want to implement a policy to disable the ShutDown command for all users in the domain except for the members of the Domain Admins security group. You create a new Group Policy object (GPO) named Shutdown. You configure the Shutdown GPO to disable the Shutdown option. You assign the Shutdown GPO to the domain. You want to ensure that the policy does not apply to the members of the Domain Admins group.
What should you do?
A. On the Shutdown GPO, deny the Apply Group Policy permission to the Domain Admins group.
B. On the Shutdown GPO, remove the Apply Group Policy permission from the Authenticated Users group. Grant the Apply Group Policy permission to the Users group.
C. Add the Domain Admins group to the Group Policy Owners group.
D. Create a new OU named No Shutdown. Move the Domain Admins group to the No Shutdown OU. Configure the No Shutdown OU to block policy inheritance.
E. On the computers that the members of the Domain Admins group use to log on, configure the local GPO to enable the Shutdown option.
We'll see you all on Monday with the Answer!
Whish you all a great Weekend!
 | |
| drewgost 2003-01-17, 5:22 am |
| Well this is a tricky one, "A" is not correct because by default there is no "apply or deny" checked off for the domains admin group, so there is no need to deny the apply GPO permission.
Leaving the permissions the way they are automatically setup, affected the users group. When I logged on as a user.( The user could not shutdown the computer, but when I logged on as a Domain Admin I could shutdown the computer.(So that would make answer's "B", "C", "D", and "E" incorrect because I did not have to change anything from default settings to attain what the question wanted to attain.
("You want to ensure that the policy does not apply to the members of the Domain Admins group.")
So my answer is "none of the above"
 | |
| l9nux 2003-01-17, 10:13 am |
| Definately A!!
Of course you can deny the Apply Group Policy permission! | |
| robertmillar 2003-01-17, 10:44 am |
| A
with the least effort | |
| Slinky 2003-01-17, 11:27 am |
| I'm going with A too.  | |
| drewgost 2003-01-17, 12:23 pm |
| Well now that I see the question differently. I am sticking with "A" because checking off the deny permission would ensure that they would never get the policy.
I always read the questions too fast,sorry for the mis-understanding. | |
| kopman 2003-01-17, 1:01 pm |
| There can be only one....
A
Kopman
PS I really need to get my A into G and sit this next week I think. | |
| B4yaman3 2003-01-18, 7:13 pm |
| From since I read it..I know the answer is A! | |
| Deja-vue 2003-01-20, 1:18 am |
| quote:
Originally posted by Deja-vue
Good Friday to you all!
You are the enterprise administrator of a Windows 2000 domain. The domain is in native mode. You want to implement a policy to disable the ShutDown command for all users in the domain except for the members of the Domain Admins security group. You create a new Group Policy object (GPO) named Shutdown. You configure the Shutdown GPO to disable the Shutdown option. You assign the Shutdown GPO to the domain. You want to ensure that the policy does not apply to the members of the Domain Admins group.
What should you do?
A. On the Shutdown GPO, deny the Apply Group Policy permission to the Domain Admins group.
B. On the Shutdown GPO, remove the Apply Group Policy permission from the Authenticated Users group. Grant the Apply Group Policy permission to the Users group.
C. Add the Domain Admins group to the Group Policy Owners group.
D. Create a new OU named No Shutdown. Move the Domain Admins group to the No Shutdown OU. Configure the No Shutdown OU to block policy inheritance.
E. On the computers that the members of the Domain Admins group use to log on, configure the local GPO to enable the Shutdown option.
We'll see you all on Monday with the Answer!
Whish you all a great Weekend!
A was correct...
The GPO should be assigned to the domain so that it applies to all users. If needed, you can then further "filter" the GPO. |
|
|
|