Creating and Managing Active Directory Groups and Organizational Units

Why must Universal Groups be used sparingly?

When membership of Universal groups changes, the changes are replicated to the GC and hence on every DC. This cost of this replication can be high over slow networks.

Which of the following is not a correct reason for creating an OU? a. To create a permanent container that cannot be moved or renamed b. To duplicate the divisions in your organization c. To delegate administration tasks d. To assign different Group Policy settings to a specific group of users or computers

a

What command line utility allows group creation?

dsadd group dsadd group <GroupDN> [parameters]

You want to modify group membership through the command line. What tool would you use?

dsmod.exe

What powershell line utility allows group creation?

new-adcomputer

What is the scope of domain local groups?

• User accounts • Computer accounts • Global groups from any domain in the forest • Universal groups • Domain local groups from the same domain

Global groups are replicated to domain controllers within the forest? True or false

False Global group memberships are replicated only to domain controllers within the same domain.

What is the scope of Universal groups?

• User accounts • Computer accounts • Global groups from any domain in the forest • Other universal groups

What is the scope of global group

• User accounts • Computer accounts • Other global groups from the same domain

In a domain running at the Windows Server 2012 domain functional level, which of the following security principals can be members of a global group? (Choose all answers that are correct.) a. Users b. Computers c. Universal groups d. Global groups

A,B,D

Choose the BEST answer What command-line utility allows administrators to modify groups' type and scope as well as add or remove members? a. PowerShell and the applicable cmdlet b. Active Directory Users and Computers console c. Active Directory Administrative Center d. Dsmod.exe

D

Which of the following groups do you use to consolidate groups and accounts that either span multiple domains or the entire forest? a. Global b. Domain local c. Built-in d. Universal

D

Which of the following is a container object within Active Directory? a. Folder b. Group c. User d. OU

D

What are the two types of group available?

Distribution Security

What is the single default OU created when installing AD DS?

Domain Controllers OU. The domain administrator must create all other OUs.

In the original AD model of group membership, what is the function of Domain Local groups?

Domain Local (DL) groups are used to PERMISSION the resource. Listen up... So for example if we have a share called SALES then the share is to be permissioned with a DL group, that will contain Global Group(s) that have the users

You are planning an Active Directory implementation for a company that currently has sales, accounting, and marketing departments. All department heads want to manage their own users and resources in Active Directory. What feature will permit you to set up Active Directory to allow each manager to manage his or her own container but not any other containers? a. Delegation of control b. Read-only domain controller c. Multimaster replication d. SRV records

A

Choose the BEST answer What are the different kinds of groups? a. There are two types: security and distribution. b. There are two types: security and distribution, and three group scopes: domain local, global, and universal. c. There are three group scopes: domain local, global, and universal. d. There are three group types: domain local, global, and universal.

C

If the user named Amy is located in the sales OU of the central.cohowinery.com domain, what is the correct syntax for referencing this user in a command line utility? a. amy.cohowinery.com b. cn=amy.ou=sales.dc=cohowinery.com c. cn=amy,ou=sales,dc=central,dc=cohowinery,dc=com d. dc=com,dn=cohowinery,ou=sales,cn=amy

C

Container objects (not OU's) can be created in the same manner as OU's? True or False

False. Container objects can only be created using special scripts.

Distribution Groups, using a special caching technique can be used in the same way as a Security group? True or False

False. It is not possible to use a Distribution Group in this way. Only AD aware programs such as Exchange can make use of distribution groups.

The model of adding Global Groups to Domain Local Groups for resource permissioning is popular and widely adopted. In Server 2012 is this model necessary? Yes or No? Please explain your answer

No. Explanation.. The use of domain local groups for resource permissions and global groups for user accounts is a holdover from Windows NT and early Windows Server versions that that did not enable global groups to have other global groups as members. Beginning with the Windows 2000 Native functional level and including the Windows Server 2003 functional level (the earliest supported by Windows Server 2012), you can nest global groups within other global groups. Therefore, there is no reason why you cannot use a global group for resource permissions and another global group for users, and then make the user group a member of the resource group.

In the original AD model of group membership, what is the function of the Global Security groups?

These contain users who need access to a resource. Listen up... Global Security groups are NOT used to give DIRECT access to a resource. Rather they are must be NESTED in a Domain Local group, which in turn will be permissioned DIRECTLY to the resource. Therefore a Domain Local group can contain many, many Global Security groups.