MCSA Exam 70-742, Chapter 4 - Configuring Group Policies, Q&A

ADMX central store

A centralized location for maintaining ADMX files so that when an ADMX file is modified from one domain controller, all DCs receive the updated file.

Microsoft Software Installation file

A collection of files gathered into a package with an .msi extension that contains the instructions that Windows Installer needs to install an application.

item-level targeting

A feature that enables you to target specific users or computers based on criteria.

elevation

A process that occurs when a user attempts to perform an action requiring administrative rights and is prompted to enter credentials.

script

A series of commands saved in a text file to be repeated easily at any time.

Starter GPO

A template (NOT GPT) that an administrator creates to be used as a baseline for new GPOs.

batch file

A text file with the .bat extension that's used to enter a command or series of commands normally typed at the command prompt.

managed policy setting

A type of group policy setting by which the setting on the user or computer account reverts to its original state when the object is no longer in the scope of the GPO containing the setting.

unmanaged policy setting

A type of group policy setting that persists on the user or computer account, meaning that it remains even after the computer or user object falls out of the GPOs scope.

Local Non-Administrators GPO

All users, including domain users when the computer is a domain member, who sign in to the computer who aren't members of the local Administration group are affected by settings in this GPO.

c. Verify that DFSR is operating correctly REFERENCE: Group Policy Replication

All your domain controllers are running Windows Server 2016. You're noticing problems with GPT replication. What should you do? a. Verify that Active Directory replication is working correctly b. Verify that FRS is operating correctly c. Verify that DFSR is operating correctly d. Check the GPOReplication flag for the GPT in the Attribute Editor

Group Policy Container

An Active Directory object stored in the System\Policies folder and can be viewed in Active Directory Users and Computers with the Advanced Features option enabled.

Group Policy Object (GPO)

An object containing policy settings that affect user and computer operating environments and security.

User Account Control polices

Determine what happens on a computer when a user attempts to perform an action that requires administrative rights. When this is fully enabled, users logged on with admin credentials run with regular user privileges.

Group Policy Preferences

Enables administrators to set up a baseline computer environment yet still allow users to make changes to configured settings.

folder redirection

Enables an administrator to set policies that redirect folders in a user's profile directory. This feature is useful when you want users to store documents on a server for centralized backup, but you don't want to change the way they access their document folders.

True of False You use the Group Policy Template to create, link, and manage GPOs and the Group Policy Management Editor to edit GPOs.

False You use the Group Policy Management console.

True of False Only the User Confguration node has an Administrative Templates folder.

False.

published application

Is not installed automatically; instead, a link to install the application is available in Control Panel's Programs and Features by clicking Install a Program from the network link.

Local Administrators GPO

Members of this group are affected by settings in this GPO. The default membership includes the local administrator account and the Domain Admins global group when the computer is a domain member.

True or False FRS is used if you have DCs in your domain that are running versions of Windows Server earlier that Windows Server 2008.

True.

c. Domain GPOs can be linked to Active Directory sites. d. The gpedit.msc tool can be used to edit local GPOs. REFERENCE: Local and Domain Group Policy Objects

Which of the following are true about GPOs? (Choose all that apply.) a. Local GPOs override domain GPOs. b. Domain GPOs are stored on member servers. c. Domain GPOs can be linked to Active Directory sites. d. The gpedit.msc tool can be used to edit local GPOs.

d. Desktop REFERENCE: User Configuration Settings

Which of the following is a subfolder in the User Configuration node but not the Computer Configuration node of a GPO? a. Network b. Windows Components c. System d. Desktop

a. Administrative templates REFERENCE: Working with Administrative Templates

Which of the following is best described as policy definition files saved in XML format? a. Administrative templates b. Security templates c. Group Policy objects d. Group Policy templates

Administrative Template file

XML-formatted text files that define policies in the Administrative Templates folder in a GPO.

auditpol.exe

allows administrators the ability not only to view an audit policy but also to set, configure, modify, restore, and even remove an audit policy at the command prompt.

Group Policy Template

Aren't stored in Active Directory but in a folder in the SYSVOL share on a domain controller. It contains all the policy settings that make up a GPO as well as related files, such as scripts.

assigned application

Can be installed automatically when the user logs on to a computer in the domain, or it can be set to install automatically if a user opens a file associated with the application.

True or False A GPC stores GPO properties and status information but actual policy settings.

True

replication

Replication of Active Directory-based GPOs ensures that all DCs have a current copy of each GPO. Changes to GPOs can be made on any DC and are replicated to all other DCs.

domain GPO

Stored in Active Directory on domain controllers. They can be linked to a site, a domain, or an OU and affect users and computers whose accounts are stored in these containers.

local GPO

Stored on local computers and can be edited with the Group Policy Object Editor snap-in. (gpedit.msc)

security template

Text files with an .inf extension that contain information for defining policy settings in the Computer Configuration\Polices\Windows Settings\Security Settings node of a local or domain GPO.

%sytemroot%\SYSVOL\domain\Polices

The local path to GPT folders on a domain controller.

GPT.ini

This file contains the version number used to determine when a GPO has been modified.

DFSR

Used when all DCs in your domain that are running Windows Server 2008 or later.

Which of the following local GPOs takes precedence on a system with multiple local GPOs?

User-specific Group Policy

a. Local Administrators d. Local Non-Administrators REFERENCE: Local and Domain Group Policy Objects

Which of the following are local GPOs on a Windows 10 computer? (Choose all that apply.) a. Local Administrators b. Local Default User c. Local Default Domain d. Local Non-Administrators

b. Link it to a container c. Use the Group Policy Objects folder of the Group Policy Management console REFERENCE: Creating and Linking GPOs

Which of the following are methods for creating a GPO? (Choose all that apply.) a. Use Active Directory Users and Computers b. Link it to a container c. Use the Group Policy Objects folder of the Group Policy Management console d. Use an XML editor

b. Create an ADMX store in the SYSVOL share, and copy the ADMX files to the ADMX store REFERENCE: The ADMX Central Store

You have been working with ADMX files to modify existing Administrative Templates and create new templates. You work on different domain controllers, depending on your location. Despite a concerted effort, your ADMX files are getting out of sync. How can you solve this problem? a. Remove group policy management tools from all but one domain controller so that policies can be managed from only one computer b. Create an ADMX store in the SYSVOL share, and copy the ADMX files to the ADMX store c. Create an ADMX store in Active Directory, and move all your ADMX files to Active Directory d. Share the %systemroot%\PolicyDefinitions folder on all your domain controllers, and set up Task Scheduler to copy ADMX files automatically from one system to all other systems

d. Disable the Apply once and do not reapply option. REFERENCE: Creating Group Policy Preferences

You have configured a group policy preference that creates a VPN connection for all computers in the GPO's scope. One user says the connection was there yesterday, but it's no longer showing in his Network Connections window. You suspect he might have deleted the connection accidentally. What can you do to make sure that the VPN connection is re-created even if a user deletes it? a. Disable the Remove this item when it is no longer valid option. b. Configure the Read-only option. c. Configure item-level targeting. d. Disable the Apply once and do not reapply option.

b. The policy setting is unmanaged. REFERENCE: Creating and Linking GPOs

You have configured a policy setting in the User Configuration node of a domain GPO and linked the GPO to OU-X. Later, you discover that you linked it to the wrong OU, so you unlink it from OU-X and link it to OU-Y, which is correct. A few days later, you find that users in OU-X still have the policy setting applied to their accounts. What's the most likely cause of the problem? a. Group policy settings haven't been refreshed. b. The policy setting is unmanaged. c. Users in OU-X have an item-level target filter configured. d. The GPO is disabled.

b. In the central store REFERENCE: Using Custom Administrative Templates

You have created a custom administrative template. You want this template to be available to all DCs so that policies can be configured with it from any DC. Where should you save it? a. In %systemroot%\PolicyDefinitions b. In the central store c. In the root of the C drive d. In ADUC

c. Open the file with ADMX Migrator. REFERENCE: Migrating Administrative Templates

You have installed an application that can be configured with Group Policy. The application came with a custom ADM file that must be replicated to all DCs. What should you do first? a. Copy the file to %windir%\PolicyDefinitions. b. Open the file with an XML editor and save it. c. Open the file with ADMX Migrator. d. Change the extension to <CTX>.inf</CTX>.

b. In the Group Policy Management Editor, configure a filter; set Managed to No, and enable Keyword Filters. REFERENCE: Working with Filters

You need to find a policy related to an application that was installed a couple years ago. You know that the policy is persistent when the computer that it's applied to falls out of scope, but you can't remember its name. You remember a word or two that might be in the policy name or comments. What can you do to find this policy quickly? a. In the Group Policy Management console, create a policy search term; set Persistent to Any, and enable Full Text search. b. In the Group Policy Management Editor, configure a filter; set Managed to No, and enable Keyword Filters. c. In the Group Policy Management console, configure a search script; set Managed to Yes, and enable Requirements Filters. d. In the Group Policy Management Editor, configure a policy screen; set Persistent to Yes, and enable Title and Comments.

d. Configure an Internet Options preference, and change the defaults in the Common tab. REFERENCE: Creating Group Policy Preferences

You want all users to have the company home page and two other Web sites loaded in tabs when they start Internet Explorer, but you want them to be able to change their home pages if they like. What should you do? a. Configure an IE policy, and set it to unmanaged. b. Configure an Internet Options preference, and accept the default options in the Common tab. c. Configure an IE policy and enable the Allow user changes option. d. Configure an Internet Options preference, and change the defaults in the Common tab.

b. Configure folder redirection in the User Configuration node of a GPO REFERENCE: Folder Redirection

You want to centrally back up the files that users store in the Documents folder in their user profiles, but you don't want users to have to change the way they access their files. What's the best way to go about this? a. Deploy a script that copies files from the Documents folder to a share on a server b. Configure folder redirection in the User Configuration node of a GPO c. Deploy a Mapped Drive preference, and tell users to save their files to the mapped drive d. Configure a backup policy in the Computer Configuration node of a GPO

c. Save the script in the SYSVOL share REFERENCE: Deploying Scripts

You want to deploy a logon script by using Group Policy. You have several sites connected via a WAN with a DC at each site. You want to make sure the script is always available when users log on from any computer at any location. What should you do? a. Create a share on the fastest DC in the network and save the script there b. Send the script via email to all users and have them save it locally c. Save the script in the SYSVOL share d. Copy the script to cloud storage

c. Publish the package under the User Configuration node REFERENCE: Software Installation Policies

You want to deploy a software package that's available to all users in the domain if they want to use it, but you don't want the package to be installed unless a user needs it. How should you configure the software installation policy? a. Publish the package under the Computer Configuration node b. Assign the package under the Computer Configuration node c. Publish the package under the User Configuration node d. Assign the package under the User Configuration node

a. Configure item-level targeting. REFERENCE: Creating Group Policy Preferences

You want to set a group policy preference that affects only computers with a CPU speed of at least 4.0 GHz. What's the best way to do this? a. Configure item-level targeting. b. Move all computers meeting the criteria to a separate OU. c. Configure the group policy client on each computer with this type of CPU. d. Create a WMI filter with the Group Policy Management Editor.

a. Run Security Configuration and Analysis on the computer to compare its security settings against a security database. REFERENCE: The Security Configuration and Analysis Snap-in

You're concerned that some domain controllers and workstations don't meet security requirements. What should you do to verify security settings on a computer against a list of known settings? a. Run Security Configuration and Analysis on the computer to compare its security settings against a security database. b. Open the Group Policy Management console on the computer, click the Security node, and run Group Policy Results. c. Run <CTX>secpol.msc</CTX> on the computer and use Group Policy Modeling. d. Use <CTX>secedit /configure</CTX> on the computer and read the report that's generated.

a. Check the versionNumber attribute of the GPC and open the<CTX> GPT.ini file<CTX/>. REFERENCE: Local and Domain Group Policy Objects

You're having replication problems with your GPOs and suspect that the version numbers have somehow gotten out of sync between the GPT and the GPC. What can you do to verify the version numbers on a GPO? a. Check the versionNumber attribute of the GPC and open the<CTX> GPT.ini file<CTX/>.\ b. Check the versionNumber attribute of the GPT and open the <CTX>GPC.ini</CTX> file c. Right-click the GPO in the Group Policy Management console, click Properties, and view the version in the General tab d. Right-click the GPO in the Group Policy Management Editor, click Properties, and view the version in the General tab

Where is a GPT stored? a. In a folder named the same as the GPO in the SYSVOL share b. In a folder named the same as the GUID of the GPO in Active Directory c. In a folder named the same as the GUID of the GPO in the SYSVOL share d. In a folder named the same as the GPO in Active Directory

c. In a folder named the same as the GUID of the GPO in the SYSVOL share REFERENCE: Local and Domain Group Policy Objects