Chapter 5: Managing Group Policies

Right-click the Group Policy Objects folder and click Manage Backups.

A junior administrator deleted a GPO accidentally, but you had backed it up. What should you do to restore the deleted GPO? Right-click the Group Policy Objects folder and click Manage Backups. Create a GPO, right-click the new GPO, and click Restore from Backup. Right-click the GPO backup file in File Explorer and click Restore. Open the Active Directory Recycle Bin, right-click the GPO object, and click Restore.

GPO status: Enabled Link status: Enabled GPO status: All Settings Disabled

After a GPO is created, which of the following are possible states for the new GPO? (Choose all that apply.) GPO status: Enabled GPO status: Unlinked Link status: Enabled GPO status: All Settings Disabled

Block inheritance

An OU structure in your domain has one OU per department, and all the computer and user accounts are in their respective OUs. You have configured several GPOs defining computer and user policies and linked the GPOs to the domain. A group of managers in the Marketing Department need different policies that differ from those of the rest of the Marketing Department users and computers, but you don't want to change the top-level OU structure. Which of the following GPO processing features are you most likely to use? WMI filtering GPO enforcement Block inheritance Loopback processing

Delegation settings Security filtering settings WMI filter links

An administrator has just backed up a GPO to save specific policy settings. Which of the following additional settings and information were also backed up in this procedure? (Choose all that apply.) Delegation settings Security filtering settings Network Policy Updates WMI filter links

Group Policy caching

An administrator would like to configure a computer to load policy information that is stored locally to speed system start-up. What client-side feature should the administrator select? Locals processing Group Policy caching WMI filtering Network Location Awareness

The Computer Configuration settings are disabled. The computer accounts have Deny Read permission.

No computers in an OU seem to be getting computer policies from the GPO linked to the OU, but users in the OU are getting user policies from this GPO. Which of the following are possible reasons that computer policies in the GPO aren't affecting the computers? (Choose all that apply.) The GPO link is disabled. The Computer Configuration settings are disabled. The computer accounts have Deny Read permission. The OU has the Block Inheritance option set.

Configure asynchronous processing when a slow link is detected

Users who log on from a branch office connected to the DC via a slow WAN link are complaining of slow logon times when you assign applications via group policies. What can you do to speed their logons? Perform a remote group policy update Configure asynchronous processing when a slow link is detected Disable Group Policy caching Configure synchronous processing when a slow link is detected

Background processing

What kind of group policy processing always occurs when a user is logged on to the computer at the time a group policy refresh occurs? Selective processing Background processing Foreground processing Slow link processing

Local GPOs, site, domain, OU

Which of the following represents the correct order in which GPOs are applied to an object that falls within the GPO's scope? Site, domain, OU, local GPOs Local GPOs, domain, site, OU Local GPOs, site, domain, OU Domain, site, OU, local GPOs

Configure loopback policy processing in Computer Configuration. Configure the desktop settings in User Configuration and link the GPO to the OU containing the demonstration computers.

You don't have policies that force settings for the look of users' computer desktops. Each user's chosen desktop settings are applied from his or her roaming profile to any computer he or she signs in to. You think it's important for users to have this choice, but you'd like a consistent look for computers used for product demonstrations to customers. What's the best way to do this without affecting users when they sign in to other computers? Create a user named Demo. Configure Demo's desktop settings and use only this user account to sign in to demonstration computers. Configure desktop policies in the Computer Configuration node of a GPO and link this GPO to the OU containing the demonstration computers. Create a GPO with a start-up script that configures desktop settings suitable for demonstration computers when these computers are started. Link the GPO to the OU containing the demonstration computers. Instruct users to restart demonstration computers before using them. Configure loopback policy processing in Computer Configuration. Configure the desktop settings in User Configuration and link the GPO to the OU containing the demonstration computers.

Slow link processing

You have a branch office connected to the main office with a sometimes unreliable and slow WAN link. Users are complaining about long logon times. Which Group Policy client feature are you most likely to configure to solve the problem? Remote update processing Slow link processing Background processing Synchronous processing

Create a global group and add the three users as members. Configure GPO security filtering so that the global group is denied access to the GPO.

You have created a GPO named RestrictU and linked it to the Operations OU (containing 30 users) with link order 3. RestrictU sets several policies in the User Configuration node. After a few days, you realize the Operations OU has three users who should be exempt from the restrictions in this GPO. You need to make sure these three users are exempt from RestrictU's settings, but all other policy settings are still in effect for them. What's the best way to proceed? Set the Enforced option on RestrictU with a WMI filter that excludes the three user accounts. Create an OU under Operations, and move the three users to this new OU. Create a GPO and link it to this new OU. Configure the new OU to block inheritance of the RestrictU GPO. Move the three users to a new OU. Create a GPO with settings suitable for the three users, and link it to the new OU. Create a global group and add the three users as members. Configure GPO security filtering so that the global group is denied access to the GPO.

GPO enforcement

You have created a GPO that sets certain security settings on computers. You need to make sure that these settings are applied to all computers in the domain. Which of the following GPO processing features are you most likely to use? GPO enforcement Loopback processing WMI filtering Block inheritance

You need to configure the firewall on the computers.

You have just finished configuring a GPO that modifies several settings on computers in the Operations OU and linked the GPO to the OU. You right-click the Operations OU and click Group Policy Update. You check on a few computers in the Operations department and find that the policies haven't been applied. On one computer, you run gpupdate and find that the policies are applied correctly. What's a likely reason the policies weren't applied to all computers when you tried to update them remotely? You need to configure the firewall on the computers. The Computer Configuration node of the GPO is disabled. A security filter that blocks the computer accounts has been set. The Operations OU has Block Inheritance set.

Run the Get-ADComputer and Invoke-GPUpdate PowerShell cmdlets.

You have just made changes to a GPO that you want to take effect as soon as possible on several user and computer accounts in the Sales OU. Most of the users in this OU are currently signed in to their computers. There are about 50 accounts. What's the best way to update these accounts with the new policies as soon as possible? Use the gpupdate /target:Sales /force command. Configure a script preference that runs gpupdate the next time the user signs out. Run the Get-ADComputer and Invoke-GPUpdate PowerShell cmdlets. Configure the GPO to perform foreground processing immediately.

Migration table

You manage a multidomain forest with domains named DomainA and DomainB. You want to use the GPOs from DomainA in DomainB without having to reconfigure all GPOs. What do you need to configure? Delegation GPO backup and restore Migration table RSoP

Run Group Policy Modeling.

You need to move some user and computer accounts in Active Directory, but before you do, you want to know how these accounts will be affected by the new group policies they'll be subject to. What can you do? Run RSoP in logging mode. Run secedit.exe with the planning option. Run Group Policy Modeling. Run Group Policy Results.

gpresult

You want to create an HTML report that shows which policies and GPOs are applied to a particular user and computer. Which command should you use? rsop gpresult gpupdate Invoke-GPReport

Configure a WMI filter on the GPO that specifies Windows 8 as the OS. Link the GPO to the domain.

You want to create policies in a new GPO that affect only computers with Windows 8 installed. You don't want to reorganize your computer accounts to do this, and you want computers that are upgraded to Windows 10 to fall out of the GPO's scope automatically. What can you do? Create a group called Win8Computers. Place all computer accounts representing computers with Windows 8 installed in this group and use this group in a security filter on the GPO. Link the GPO to the domain. For each policy, use selective application to specify Windows 8 as the OS. Configure a WMI filter on the GPO that specifies Windows 8 as the OS. Link the GPO to the domain. Create a new OU, place all computer accounts representing computers with Windows 8 installed in this OU, and link the GPO to this O

Run gpofix.

You were hired to fix problems with group policies at a company. You open the GPMC to look at the default GPOs and see that extensive changes have been made to both. You want to restore settings to a baseline so that you know where to start. What should you do? Delete the default GPOs and create new GPOs with the same names. Run gpofix. Run gpupdate /revert. Create a domain and use GPO migration