Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 11:

  Your company has an Active Directory domain. A user attempts to log on to a computer that was turned off for twelve weeks. The administrator receives an error message that authentication has failed.

  You need to ensure that the user is able to log on to the computer.

  What should you do?

  A. Run the netsh command with the set and machine options.
  B. Reset the computer account. Disjoin the computer from the domain, and then rejoin the computer to the domain.
  C. Run the netdom TRUST /reset command.
  D. Run the Active Directory Users and Computers console to disable, and then enable the computer account.
  B. Reset the computer account. Disjoin the computer from the domain, and then rejoin the computer to the domain.

  ---

  Answer: Reset the computer account. Disjoin the computer from the domain, and then rejoin the computer to the domain.

  http://social.technet.microsoft.com/wiki/contents/articles/9157.trust-relationship-between-workstation- andprimary-domain-failed.aspx

  Trust Relationship between Workstation and Primary Domain failed What are the common causes which generates this message on client systems? There might be multiple reasons for this kind of behaviour. Below are listed a few of them:

  1.

  Single SID has been assigned to multiple computers.

  2.

  If the Secure Channel is Broken between Domain controller and workstations

  3.

  If there are no SPN or DNSHost Name mentioned in the computer account attributes

  4.

  Outdated NIC Drivers.

  How to Troubleshoot this behaviour? ..

  2. If the Secure Channel is Broken between Domain controller and workstations When a Computer account is joined to the domain, Secure Channel password is stored with computer account in domain controller. By default this password will change every 30 days (This is an automatic process, no manual intervention is required). Upon starting the computer, Netlogon attempts to discover a DC for the domain in which its machine account exists. After locating the appropriate DC, the machine account password from the workstation is authenticated against the password on the DC. If there are problems with system time, DNS configuration or other settings, secure channel's password between Workstation and DCs may not synchronize with each other. A common cause of broken secure channel [machine account password] is that the secure channel password held by the domain member does not match that held by the AD. Often, this is caused by performing a Windows System Restore (or reverting to previous backup or snapshot) on the member machine, causing an old (previous) machine account password to be presented to the AD.

  Resolution:

  Most simple resolution would be unjoin/disjoin the computer from the domain and rejoin the computer account back to the domain. (this is a somewhat similar principle to performing a password reset for a user account)

  Or

  You can go ahead and reset the computer account using netdom.exe tool http://technet.microsoft.com/en-us/library/cc772217%28v=ws.10%29.aspx Netdom Enables administrators to manage Active Directory domains and trust relationships

  from the command prompt.

  Netdom is a command-line tool that is built into Windows Server 2008 and Windows Server 2008 R2. It is available if you have the Active Directory Domain Services (AD DS) server role installed. It is also available if you install the Active

  Directory Domain Services Tools that are part of the Remote Server Administration Tools (RSAT).

  You can use netdom to:

  Join a computer that runs Windows XP Professional, Windows Vista, or Windows 7 to a Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows 2000, or Windows NT 4.0 domain. Manage computer accounts for

  domain member workstations and member servers.

  Management operations include:

  Establish one-way or two-way trust relationships between domains, including the following kinds of trust relationships:

  Verify or reset the secure channel for the following configurations:

  *

  Member workstations and servers.

  *

  Backup domain controllers (BDCs) in a Windows NT 4.0 domain.

  *

  Specific Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, or Windows 2000 replicas.

  Manage trust relationships between domains.

  Syntax

  NetDom [] [{/d: | /domain:} ] [] http://technet.microsoft.com/en-us/library/cc788073%28v=ws.10%29.aspx Netdom reset Resets the secure connection between a workstation and a domain

  controller. Syntax netdom reset {/d: | /domain:} [{/s: | /server:}] [{/uo: | /usero:} {/po: | /passwordo}{|*}] [{/help | /?}]

  Further information:

  http://technet.microsoft.com/en-us/library/cc835085%28v=ws.10%29.aspx Netdom trust

  Establishes, verifies, or resets a trust relationship between domains. Syntax netdom trust {/d: | /domain:} [{/ud: | /userd:} [\] [{/pd: | /passwordd:}{|*}] [{/uo: | /

  usero:}] [{/po: | /passwordo:}{|*}] [/verify] [/reset] [/passwordt:] [/add [/realm]] [/remove [/force]] [/twoway] [/kerberos] [/transitive[:{YES|NO}]] [/oneside:{TRUSTED | TRUSTING}] [/force][/

  quarantine[:{YES | NO}]] [/namesuffixes: [/togglesuffix:#]] [/nableSIDHistory] [/ForestTRANsitive] [/SelectiveAUTH][/AddTLN][/AddTLNEX][/RemoveTLN] [/RemoveTLNEX][{/help | /?}]

• Question 12:

  Your network contains an Active Directory domain. The domain contains two file servers. The file servers are configured as shown in the following table.

  

  You create a Group Policy object (GPO) named GPO1 and you link GPO1 to OU1.

  You configure the advanced audit policy as shown in the exhibit. (Click the Exhibit button.)

  

  You discover that the settings are not applied to Server1. The settings are applied to Server2.

  You need to ensure that access to the file shares on Server1 is audited.

  What should you do?

  A. On Server1, run secedit.exe and specify the /configure parameter.
  B. On Server1, run auditpol.exe and specify the /set parameter.
  C. From GPO1, configure the Security Options.
  D. From Active Directory Users and Computers, modify the permissions of the computer account for Server1.
  E. From Active Directory Users and Computers, add Server1 to the Event Log Readers group.
  B. On Server1, run auditpol.exe and specify the /set parameter.

• Question 13:

  Your company has a domain controller that runs Windows Server 2008. The domain controller has the backup features installed.

  You need to perform a non-authoritative restore of the doman controller using an existing backup file.

  What should you do?

  A. Restart the domain controller in Directory Services Restore Mode and use wbadmin to restore critical volume
  B. Restart the domain controller in Directory Services Restore Mode and use the backup snap-in to restore critical volume
  C. Restart the domain controller in Safe Mode and use wbadmin to restore critical volume
  D. Restart the domain controller in Safe Mode and use the backup snap-in to restore critical volume
  A. Restart the domain controller in Directory Services Restore Mode and use wbadmin to restore critical volume

  ---

  Almost identical to B42

  http://technet.microsoft.com/en-us/library/cc816627%28v=ws.10%29.aspx Performing Nonauthoritative Restore of Active Directory Domain Services A nonauthoritative restore is the method for restoring Active Directory Domain Services (AD

  DS) from a system state, critical-volumes, or full server backup. A nonauthoritative restore returns the domain controller to its state at the time of backup and then allows normal replication to overwrite that state with any changes that occurred

  after the backup was taken. After you restore AD DS from backup, the domain controller queries its replication partners. Replication partners use the standard replication protocols to update AD DS and associated information, including the

  SYSVOL shared folder, on the restored domain controller.

  You can use a nonauthoritative restore to restore the directory service on a domain controller without reintroducing or changing objects that have been modified since the backup. The most common use of a nonauthoritative restore is to

  reinstate a domain controller, often after catastrophic or debilitating hardware failures.

  In the case of data corruption, do not use nonauthoritative restore unless you have confirmed that the problem is with AD DS.

  Nonauthoritative Restore Requirements You can perform a nonauthoritative restore from backup on a Windows Server 2008 system that is a standalone server, member server, or domain controller. On domain controllers that are running

  Windows Server 2008, you can stop and restart AD DS as a service. Therefore, in Windows Server 2008, performing offline defragmentation and other database management tasks does not require restarting the domain controller in Directory

  Services Restore Mode (DSRM). However, you cannot perform a nonauthoritative restore after simply stopping the AD DS service in regular startup mode. You must be able to start the domain controller in Directory Services Restore Mode

  (DSRM). If the domain controller cannot be started in DSRM, you must first reinstall the operating system.

  To perform a nonauthoritative restore, you need one of the following types of backup for your backup source:

  System state backup: Use this type of backup to restore AD DS. If you have reinstalled the operating system, you must use a critical-volumes or full server backup. If you are restoring a system state backup, use the wbadmin start

  systemstaterecovery command. Critical-volumes backup: A critical-volumes backup includes all data on all volumes that contain operating system and registry files, boot files, SYSVOL files, or Active Directory files. Use this type of backup if

  you want to restore more than the system state. To restore a critical-volumes backup, use the wbadmin start recovery command.

  Full server backup: Use this type of backup only if you cannot start the server or you do not have a system state or critical-volumes backup. A full server backup is generally larger than a critical-volumes backup.

  Restoring a full server backup not only rolls back data in AD DS to the time of backup, but it also rolls back all data in all other volumes. Rolling back this additional data is not necessary to achieve nonauthoritative restore of AD DS.

• Question 14:

  Your network consists of a single Active Directory domain. User accounts for engineering department are located in an OU named Engineering.

  You need to create a password policy for the engineering department that is different from your domain password policy.

  What should you do?

  A. Create a new GPO. Link the GPO to the Engineering OU.
  B. Create a new GPO. Link the GPO to the domain. Block policy inheritance on all OUs except for the Engineering OU.
  C. Create a global security group and add all the user accounts for the engineering department to the group. Create a new Password Policy Object (PSO) and apply it to the group.
  D. Create a domain local security group and add all the user accounts for the engineering department to the group. From the Active Directory Users and Computer console, select the group and run the Delegation of Control Wizard.
  C. Create a global security group and add all the user accounts for the engineering department to the group. Create a new Password Policy Object (PSO) and apply it to the group.

  ---

  http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/b3d11cd4-897b-4da1-bae1- f1b69441175b

  Complex Password Policy on an OU

  Q: Is it possible to apply a complex password policy to an OU instead of entire domain (Windows 2008 R2). I'm under the impression it can only be applied to either a security group or an individual user.

  A1:

  I beleive you are referering to PSC and PSO.

  The Password Settings Container (PSC) object class is created by default under the System container in the domain. It stores the Password Settings objects (PSOs) for that domain. You cannot rename, move, or delete this container.

  PSOs cannot be applied to organizational units (OUs) directly. If your users are organized into OUs, consider creating global security groups that contain the users from these OUs and then applying the newly defined fine-grained password

  and account lockout policies to them. If you move a user from one OU to another, you must update user memberships in the corresponding global security groups. Groups offer better flexibility for managing various sets of users than OUs. For

  the fine-grained password and account lockout policies to function properly in a given domain, the domain functional level of that domain must be set to Windows Server 2008. Fine-grained password policies apply only to user objects and

  global security groups. They cannot be applied to Computer objects.

  For more info, please see below article:

  http://technet.microsoft.com/en-us/library/cc770842(WS.10).aspx AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide A2:

  Here is a link to how you setup find grain password policy... However you can only apply it to a Security Group.

  http://www.grouppolicy.biz/2011/08/tutorial-how-to-setup-default-and-fine-grain-password-policy/ A3:

  In addition, for fine grated password policy ; you need DLF 2008 and you can apply that policy on a single user and only global security group.

  Find the step by step info.

  http://social.technet.microsoft.com/wiki/contents/articles/4627.aspx http://www.grouppolicy.biz/2011/08/tutorial-how-to-setup-default-and-fine-grain-password-policy/ Tutorial: How to setup Default and Fine Grain Password Policy One strange

  thing that still seems to catch a lot of people out is that you can only have one password policy for your user per domain. This catches a lot of people out as they apply a password policy to an OU in their AD thinking that it will apply to all the

  users in that OU.... but it doesn't. Microsoft did introduce Fine Grain Password Policies with Windows Server 2008 however this can only be set based on a security group membership and you still need to use the very un-user-friendly ADSI

  edit tool to make the changes to the policy.

  Below I will go through how you change the default domain password policy and how you then apply a fine grain password policy to your environment. The Good news is setting the default password policy for a domain is really easy. The Bad

  news is that setting a fine grain password policy is really hard.

  How to set a Default Domain Password Policy

  Step 1

  Create a new Group Policy Object at the top level of the domain (e.g. "Domain Password Policy").

  

  Note: I have elected to create a new GPO at the top of the domain in this case as I always try to avoid modifying the "Default Domain Policy", see references below.

  Reference:

  http://technet.microsoft.com/en-us/library/cc736813(WS.10).aspx TechNet: Linking GPOs

  If you need to modify some of the settings contained in the Default Domain Policy GPO, it is recommended that you create a new GPO for this purpose, link it to the domain, and set the Enforce option.

  http://technet.microsoft.com/en-us/library/cc779159(WS.10).aspx TechNet: Establishing Group Policy Operational Guidelines Do not modify the default domain policy or default domain controller policy unless necessary. Instead, create a new

  GPO at the domain level and set it to override the default settings in the default policies.

  Step 2

  Edit the "Domain Password Policy" GPO and go to Computer Configurations>Policies>Windows Settings>Security Settings>Account Policy>Password Policy and configured the password policies settings to the configuration you desire.

  

  Step 3

  Once you have configured the password policy settings make the "Domain Password Policy" GPO the highest in the Linked GPO processing order.

  TIP: Make sure you inform all your users when you are going to do this as it may trigger them to change their password the next time they logon.

  

  Done... told you it was easy....

  Note: Even if you apply the password policies to the "Domain Controllers" OU it will not modify the domain's password policy. As far as I know this is the only exception to the rule as to how GPO's apply to objects. As you can see in the image

  below the "Minimum password length" in the "Domain Password Policy" GPO is still applied to the domain controller even though I have another GPO linking to the "Domain Controllers" OU configuration the same setting.

  

  For a better explanation as to why the GPO that is linked to the Domain and not the Domain Controllers is used for the password policy for all users check out Jorge's Quest for Knowledge! Why GPOs with Password and Account Lockout Policy Settings must be linked to the AD domain object to be affective on AD domain user accounts (http://blogs.dirteam.com/blogs/jorge/archive/2008/12/16/why-gpos-with-password-and- accountlockout- policy-settings-must-be-linked-tothe-ad-domain-object-to-be-affective-on-ad-domain- useraccounts.aspx) How to set a Fine Grain Password Policy Fine Grain Password Policies (FGPP) were introduced as a new feature of Windows Server 2008. Before this the only way to have different password polices for the users in your environment was to have separate domains... OUCH! Pre-Requisites/Restrictions You domain must be Windows Server 2008 Native Mode, this means ALL of your domain controllers must be running Windows Server 2008 or later. You can check this by selection the "Raise domain functional level" on the top of the domain in Active Directory Users and Computers.

  

  Reference

  http://technet.microsoft.com/en-us/library/cc770394(WS.10).aspx AD DS: Fine-Grained Password Policies

  The domain functional level must be Windows Server 2008. The other restriction with this option is that you can only apply FGPP to users object or users in global security groups (not computers).

  Reference

  http://technet.microsoft.com/en-us/library/cc770394(WS.10).aspx AD DS: Fine-Grained Password Policies

  Fine-grained password policies apply only to user objects ... and global security groups. TIP: If you setup an "Automatic Shadow Group (http://policelli.com/blog/archive/2008/01/15/manage- shadowgroups-in-windows-server-2008/)" you can

  apply these password policies to users automatically to any users located in an OU.

  Creating a Password Setting Object (PSO)

  Step 1

  Under Administrator Tools Open ADSI Edit and connect it to a domain and domain controller you want to setup the new password policy.

  

  Note: If you do not see this option go to "Turn Windows Features On or Off" and make sure the "AD DS and AD LDS Tools" are installed. (You will need RSAT also installed if you are on Windows 7).\

  Step 2

  Double click on the "CN=DomainName" then double click on "CN=System" and then double click on "CN=Password Settings Container".

  

  Step 3

  Right click on "CN=Password Settings Container" and then click on "New" then "Object.

  

  Step 4

  Click on "Next"

  

  Step 5

  Type the name of the PSO in the "Value" field and then click "Next"

  

  Note: With the exception of the password length the following values are all the same as the default values in the "Default Domain Policy".

  Step 6

  Type in a number that will be the Precedence for this Password Policy then click "Next". Note: This is used if a users has multiple Password Settings Object (PSO) applied to them.

  

  Step 7

  Type "FALSE" in the value field and click "Next"

  Note: You should almost never use "TRUE" for this setting.

  

  Step 8

  Type "24" in the "Value" field and click "Next"

  

  Step 9

  Type "TRUE" in the "Value" field and click "Next"

  

  Step 10

  Type "5" in the "Value" field and click "Next"

  

  Step 11

  Type "1:00:00:00" in the "Value" field and click "Next"

  

  Step 12

  Type "42:00:00:00" in the "Value" field and click "Next"

  

  Step 13

  Type "10" in the "Value" field and click "Next"

  

  Step 14

  Type "0:00:30:00" field and click "Next"

  

  Step 15

  Type "0:00:33:00" in the "Value" field and click "Next"

  

  Step 16 Click "Finish"

  

  Step 17

  Open Active Directory Users and Computers and navigate to "System > Password Settings Container"

  Note: Advanced Mode needs to be enabled.

  You have now created the Password Settings Object (PSO) and you can close the ADSIEdit tool.

  Now to apply the PSO to a users or group...

  

  Step 18

  Double click on the PSO you created then click on the "Attribute Editor" tab and then select the "msDS-PSOAppliedTo" attribute and click "Edit"

  

  Step 19

  Click "Add Windows Accounts...." button.

  

  Step 20

  Select the user or group you want to apply this PSO and click "OK"

  

  Step 21 Click "OK"

  

  Step 22 Click "OK"

  

  And your are done... (told you it was hard).

  Fine Grain Password Policies as you can see are very difficult to setup and manage so it is probably best you use them sparingly in your organisation... But if you

  really have to have a simple password or extra complicated password then at least it give you away to do this without having to spin up another domain.

• Question 15:

  ABC.com has a network that consists of a single Active Directory domain. A technician has accidently deleted an Organizational unit (OU) on the domain controller. As an administrator of ABC.com, you are in process of restoring the OU.

  You need to execute a non-authoritative restore before an authoritative restore of the OU.

  Which backup should you use to perform non- authoritative restore of Active Directory Domain Services (AD DS) without disturbing other data stored on domain controller?

  A. Critical volume backup
  B. Backup of all the volumes
  C. Backup of the volume that hosts Operating system
  D. Backup of AD DS folders
  E. all of the above
  A. Critical volume backup

  ---

  http://technet.microsoft.com/en-us/library/cc730683%28v=ws.10%29.aspx Performing a Nonauthoritative Restore of AD DS

  To perform a nonauthoritative restore of Active Directory Domain Services (AD DS), you need at least a system state backup. To restore a system state backup, use the wbadmin start systemstaterecovery command. The procedure in this topic uses the wbadmin start systemstaterecovery command. You can also use a critical-volume backup to perform a nonauthoritative restore, or a full server backup if you do not have a system state or critical-volume backup. A full server backup is generally larger than a critical-volume backup or system state backup. Restoring a full server backup not only rolls back data in AD DS to the time of backup, but it also rolls back all data in other volumes. Rolling back this additional data is not necessary to achieve nonauthoritative restore of AD DS. To restore a critical- volume backup or full server backup, use the wbadmin start recovery command.

• Question 16:

  You have a Windows Server 2008 R2 Enterprise Root CA.

  Security policy prevents port 443 and port 80 from being opened on domain controllers and on the issuing CA.

  You need to allow users to request certificates from a Web interface. You install the Active Directory Certificate Services (AD CS) server role.

  What should you do next?

  A. Configure the Online Responder Role Service on a member server.
  B. Configure the Online Responder Role Service on a domain controller.
  C. Configure the Certificate Enrollment Web Service role service on a member server.
  D. Configure the Certificate Enrollment Web Service role service on a domain controller.
  C. Configure the Certificate Enrollment Web Service role service on a member server.

  ---

  http://technet.microsoft.com/en-us/library/dd759209.aspx Certificate Enrollment Web Service Overview

  The Certificate Enrollment Web Service is an Active Directory Certificate Services (AD CS) role service that enables users and computers to perform certificate enrollment by using the HTTPS protocol. Together with the Certificate Enrollment

  Policy Web Service, this enables policy-based certificate enrollment when the client computer is not a member of a domain or when a domain member is not connected to the domain.

  Personal note:

  Since domain controllers are off-limits (regarding open ports), you are left to install the Certificate Enrollment Web Service role service on a plain member server

• Question 17:

  Your company has an Active Directory forest that contains a single domain. The domain member server has an Active Directory Federation Services (AD FS) role installed.

  You need to configure AD FS to ensure that AD FS tokens contain information from the Active Directory domain.

  What should you do?

  A. Add and configure a new account partner.
  B. Add and configure a new resource partner.
  C. Add and configure a new account store.
  D. Add and configure a Claims-aware application.
  C. Add and configure a new account store.

  ---

  http://technet.microsoft.com/en-us/library/cc732095.aspx Understanding Account Stores

  Active Directory Federation Services (AD FS) uses account stores to log on users and extract security claims for those users. You can configure multiple account stores for a single Federation Service. You can also define their priority. The

  Federation Service uses Lightweight Directory Access Protocol (LDAP) to communicate with account stores. AD FS supports the following two account stores:

  Active Directory Domain Services (AD DS)

  Active Directory Lightweight Directory Services (AD LDS)

• Question 18:

  Your network contains an Active Directory domain named contoso.com. The domain contains five domain controllers.

  You add a logoff script to an existing Group Policy object (GPO).

  You need to verify that each domain controller successfully replicates the updated group policy. Which two objects should you verify on each domain controller? (Each correct answer presents part of the solution. Choose two.)

  A. \\servername\SYSVOL\contoso.com\Policies\{GUID}\gpt.ini
  B. \\servername\SYSVOL\contoso.com\Policies\{GUID}\machine\registry.pol
  C. the uSNChanged value for the CN={GUID},CN=Policies,CN=System,DC=contoso,DC=com container
  D. the versionNumber value for the CN={GUID},CN=Policies,CN=System,DC=contoso,DC=com container
  A. \\servername\SYSVOL\contoso.com\Policies\{GUID}\gpt.ini
  D. the versionNumber value for the CN={GUID},CN=Policies,CN=System,DC=contoso,DC=com container

  ---

  http://technet.microsoft.com/en-us/library/cc784268%28v=ws.10%29.aspx How Core Group Policy Works ... The Gpt.ini File The Gpt.ini file is located at the root of each Group Policy template. Each Gpt.ini file contains GPO version information. Except for the Gpt.ini files created for the default GPOs, a display name value is also written to the file. Each Gpt.ini file contains the GPO version number of the Group Policy template. [General] Version=65539 Normally, this is identical to the version-number property of the corresponding GroupPolicyContainer object. It is encoded in the same way -- as a decimal representation of a 4 byte hexadecimal number, the upper two bytes of which contain the GPO user settings version and the lower two bytes contain the computer settings version. In this example the version is equal to 10003 hexadecimal giving a user settings version of 1 and a computer settings version of 3. Storing this version number in the Gpt.ini allows the CSEs to check if the client is out of date to the last processing of policy settings or if the currently applied policy settings (cached policies) are up-to-date. If the cached version is different from the version in the Group Policy template or Group Policy container, then policy settings will be reprocessed.

• Question 19:

  Your company has an Active Directory domain that has an organizational unit named Sales. The Sales organizational unit contains two global security groups named sales managers and sales executives.

  You need to apply desktop restrictions to the sales executives group.

  You must not apply these desktop restrictions to the sales managers group.

  You create a GPO named DesktopLockdown and link it to the Sales organizational unit.

  What should you do next?

  A. Configure the Deny Apply Group Policy permission for Authenticated Users on the DesktopLockdown GPO.
  B. Configure the Deny Apply Group Policy permission for the sales executives on the DesktopLockdown GPO.
  C. Configure the Allow Apply Group Policy permission for Authenticated Users on the DesktopLockdown GPO.
  D. Configure the Deny Apply Group Policy permission for the sales managers on the DesktopLockdown GPO.
  D. Configure the Deny Apply Group Policy permission for the sales managers on the DesktopLockdown GPO.

  ---

  http://support.microsoft.com/kb/816100

  How to prevent domain Group Policies from applying to certain user or computer accounts Typically, if you want Group Policy to apply only to specific accounts (either user accounts, computer accounts, or both), you can put the accounts in an organizational unit, and then apply Group Policy at that organizational unit level. However, there may be situations where you want to apply Group Policy to a whole domain, although you may not want those policy settings to also apply to administrator accounts or to other specific users or groups.

  http://www.grouppolicy.biz/2010/05/how-to-exclude-individual-users-or-computers-from-a-group- policy-object/Best Practice: How to exclude individual users or computers from a Group Policy Object One of the common question I see on the forums from time to time is how to exclude a user and/or a computer from having a Group Policy Object (GPO) applied. This is a relatively straight forward process however I should stress this should be used sparingly and should always be done via group membership to avoid the administrative overhead of having to constantly update the security filtering on the GPO.

  Step 1. Open the Group Policy Object that you want to apply an exception and then click on the "Delegation" tab and then click on the "Advanced" button.

  

  Step 2. Click on the "Add" button and select the group (recommended) that you want to exclude from having this policy applied.

  

  Step 3. In this example I am excluding the "Users GPO Exceptions" group for this policy. Select this group in the "Group or user names" list and then scroll down the permission and tick the "Deny" option against the "Apply Group Policy" permission.

  

  Now any members of this "User GPO Exceptions" security group will not have this Group Policy Object applied.

  Having a security group to control this exception makes it much easier to control as someone only needs to modify the group membership of the group to makes changes to who (or what) get the policy applied. This makes the delegation of this task to level 1 or level 2 support much more practical as you don't need to grant them permission to the Group Policy Objects.

• Question 20:

  Your company security policy requires complex passwords.

  You have a comma delimited file named import.csv that contains user account information. You need to create user account in the domain by using the import.csv file.

  You also need to ensure that the new user accounts are set to use default passwords and are disabled.

  What should you do?

  A. Modify the userAccountControl attribute to disabled. Run the csvde i k f import.csv command. Run the DSMOD utility to set default passwords for the user accounts.
  B. Modify the userAccountControl attribute to accounts disabled. Run the csvde -f import.csv command. Run the DSMOD utility to set default passwords for the user accounts.
  C. Modify the userAccountControl attribute to disabled. Run the wscript import.csv command. Run the DSADD utility to set default passwords for the imported user accounts.
  D. Modify the userAccountControl attribute to disabled. Run ldifde -i -f import.csv command. Run the DSADD utility to set passwords for the imported user accounts.
  A. Modify the userAccountControl attribute to disabled. Run the csvde i k f import.csv command. Run the DSMOD utility to set default passwords for the user accounts.

  ---

  Personal note:

  The correct command should be:

  csvde - i -k -f import.csv

  http://support.microsoft.com/kb/305144

  How to use the UserAccountControl flags to manipulate user account properties When you open the properties for a user account, click the Account tab, and then either select or clear the check boxes in the Account options dialog box,

  numerical values are assigned to the UserAccountControl attribute. The value that is assigned to the attribute tells Windows which options have been enabled.

  You can view and edit these attributes by using either the Ldp.exe tool or the Adsiedit.msc snap-in. The following table lists possible flags that you can assign. You cannot set some of the values on a user or computer object because these

  values can be set or reset only by the directory service. Note that Ldp.exe shows the values in hexadecimal. Adsiedit.msc displays the values in decimal. The flags are cumulative. To disable a user's account, set the UserAccountControl

  attribute to 0x0202 (0x002 + 0x0200). In decimal, this is 514 (2 + 512).

  http://technet.microsoft.com/en-us/library/cc732101%28v=ws.10%29.aspx Csvde

  Imports and exports data from Active Directory Domain Services (AD DS) using files that store data in the comma-separated value (CSV) format. You can also support batch operations based on the CSV file format standard.

  Syntax:

  Csvde [-i] [-f ] [-s ] [-c ] [-v] [-j ] [-t ] [-d

  ] [-r ] [-p ] [-o ] [-g] [-m] [-n] [-k] [-a

  { | *}] [-b { | *}] Parameters

  Specifies import mode. If not specified, the default mode is export. -f Identifies the import or export file name.

  -k

  Ignores errors during an import operation and continues processing. http://technet.microsoft.com/en-us/library/cc732954%28v=ws.10%29.aspx Dsmod user Modifies attributes of one or more existing users in the directory.

  Syntax:

  dsmod user ... [-upn ] [-fn ] [-mi ] [-ln ] [- display] [-empid ] [-pwd ( |

  *)] [-desc ] [- office ] [-tel

  ] [-email ] [-hometel ] [-pager ] [-mobile ] [-fax ] [-iptel

  ] [- webpg ] [-title