1

Review Questions
1. Which of the following is a GPO on a Vista computer? (Choose all that apply.) a. Local Administrators b. ocal !efault "ser c. ocal !efault !omain d. Local Non-Administrators #. Where is a GP$ store%? a. In a folder named the same as the GPO in the Sysvol share b. &n a fol%er name% the same as the G"&! of the GPO in 'cti(e !irectory c. &n a fol%er name% the same as the G"&! of the GPO in the )ys(ol share %. &n a fol%er name% the same as the GPO in 'cti(e !irectory *. ' user+specific local GPO ta,es prece%ence o(er a site+lin,e% GPO. rue or -alse? .. /ou0re ha(ing replication problems with your GPOs an% suspect that the (ersion numbers ha(e somehow gotten out of sync between the GP$ an% the GPC. What can you %o to (erify the (ersion numbers on a GPO? a. !hec" the versionNum#er attri#ute of the GP! and o$en the GP .ini file. b. Chec, the (ersion 1umber attribute of the GP$ an% open the GPC.ini file. c. 2ight+clic, the GPO in GP3C4 clic, Properties4 an% (iew the (ersion in the General tab. %. 2ight+clic, the GPO in GP354 clic, Properties4 an% (iew the (ersion in the General tab. 6. 'll your %omain controllers are running Win%ows )er(er #778. /ou0re noticing problems with GP$ replication. What shoul% you chec,? a. Verify that 'cti(e !irectory replication is wor,ing correctly. b. Verify that -2) is operating correctly. c. Verify that !-)2 is operating correctly. d. !hec" the GPOR re$lication fla% for the GP in the Attri#ute &ditor. 9. $he i%eal way to create a GPO on a pro%uction system is to right+clic, the O" to which it will be lin,e% an% clic, :Create a GPO in this %omain4 an% in, it here.; rue or -alse? <. /ou ha(e create% a GPO that %efines settings only in the ocal Policies no%e. /ou want the settings to apply to all computers in the %omain an% ta,e prece%ence o(er any other GPOs. Which of the following is the best approach? a. Lin" the new GPO to the domain' and unlin" the (efault (omain Policy. Ri%ht-clic" the domain o#)ect and clic" &nforced. b. in, the new GPO to each O" containing computer accounts4 an% ma,e sure it has lin, or%er 1.

2 c. in, the new GPO to the %omain4 an% then right+clic, the new GPO an% clic, 5nforce%. %. in, the new GPO to the %omain4 ma,e sure it has the highest lin, or%er4 an% then right clic, the %omain ob=ect an% clic, >loc, &nheritance. 8. Which of the following represents the correct or%er in which GPOs are applie% to an ob=ect that falls within the GPO0s scope? a. )ite4 %omain4 O"4 local GPOs #. Local GPOs' domain' site' O* c. !omain4 site4 O"4 local GPOs %. ocal GPOs4 site4 %omain4 O" ?. /our networ, consists of three sites an% two %omains4 with some computers from both %omains locate% at each site. 5ach site has certain security settings that shoul% apply to all computers from both %omains when they0re locate% at the site. What0s the best way to ensure that the correct security settings will be applie% to the computers at each site? a. Create three O"s in each %omain4 one for each site. &n both %omains4 place the computer accounts in the O" correspon%ing to the site where the computer is locate%. 'pply a GPO with the appropriate security settings to each O" in both %omains. b. Create three GPOs4 one for each site4 with the appropriate security settings. 'pply the GPOs to the correspon%ing site4 an% enforce the GPO. c. !reate three GPOs' one for each site. A$$ly the GPOs to the domain o#)ect in #oth domains. !reate three %rou$s' one for each site' and $lace the com$uter accounts in the a$$ro$riate %rou$s. *se GPO filterin% to ma"e sure the $olicy confi%ured for each site affects only the corres$ondin% %rou$ of com$uters. %. On each computer in each site4 configure the local GPO in GPO5 with the appropriate security settings. &n GPO54 right+clic, the Computer Configuration no%e an% clic, >loc, &nheritance. 17. Ob=ects in an O" with the >loc, &nheritance option set are affecte% by a %omain+ lin,e% GPO with the 5nforce% option set. $rue or -alse? 11. /ou ha(e create% a GPO name% 2estrict" an% lin,e% it to the Operations O" (containing *7 users) with lin, or%er *. 2estrict" sets se(eral policies in the "ser Configuration no%e. 'fter a few %ays4 you reali@e the Operations O" has three users who shoul% be eAempt from the restrictions in this GPO. /ou nee% to ma,e sure these three users are eAempt from 2estrict"0s settings4 but all other policy settings are still in effect for them. What0s the best way to procee%?

3 a. 3o(e the three users to a new O". Create a GPO with settings appropriate for the three users4 an% lin, it to the new O". b. Create an O" un%er Operations4 an% mo(e the three users to this new O". Create a GPO4 an% lin, it to this new O". Configure the new O" to bloc, inheritance of the 2estrict" GPO. c. !reate a %lo#al %rou$ and add the three users as mem#ers. !onfi%ure GPO security filterin% so that the %lo#al %rou$ is denied access to the GPO. %. )et the 5nforce% option on 2estrict" with an 5nforce filter that eAclu%es the three user accounts. 1#. /ou ha(e a new sales forecasting application that you want to ma,e a(ailable to all users in the )ales O". /ou want them to be able to fin% this application on the )tart menu of any computer they log on to. What0s the best way to %o this? a. !reate a new GPO' and confi%ure a Software Installation $olicy in the *ser !onfi%uration node to assi%n the a$$lication. Lin" the GPO to the Sales O*. b. Create a new GPO4 an% configure a )oftware &nstallation policy in the "ser Configuration no%e to publish the application. in, the GPO to the )ales O". c. Create a new GPO4 an% configure a )oftware &nstallation policy in the Computer Configuration no%e to assign the application. in, the GPO to the )ales O". %. Create a new GPO4 an% configure a )oftware &nstallation policy in the Computer Configuration no%e to publish the application. in, the GPO to the )ales O". 1*. /ou ha(e been getting phone calls about resetting the passwor% for a group of 17 part+time employees4 who wor, only one or two %ays per wee, an% ha(e limite% access to networ, resources. >ecause of %omain account policies4 they ha(e to change their passwor%s e(ery 1. %ays an% are reBuire% to use compleA passwor%s of at least 17 characters. /ou thin, these users ha(e a %ifficult time ,eeping up with their passwor%s because of their infreBuent wor,ing hours. What can you %o to re%uce phone calls from them without compromising the security of other users0 passwor%s? a. Place these users an% their computers in their own O". Create a new GPO with less restricti(e passwor% settings4 an% lin, it to the new O". b. 2emo(e these users0 computers from the %omain an% set a local GPO with less restricti(e passwor% settings on each of their computers. c. Place these users an% their computers in their own O". &n GP3C4 create a new P)O in the Group Policy Ob=ects fol%er4 an% lin, it to the O". d. Add the $art-time users to a %lo#al %rou$. *se A(SI &dit to create a new PSO' and lin" the PSO to the %lo#al %rou$. 1.. /ou ha(e been wor,ing with '!3C files to mo%ify eAisting '%ministrati(e $emplates an% to create new templates. /ou wor, on %ifferent %omain controllers4 %epen%ing on your location. !espite a concerte% effort4 your '!3C files are getting out of sync. Dow can you sol(e this problem?

4 a. 2emo(e group policy management tools from all but one %omain controller so that policies can be manage% from only one computer. b. Create an '!3C store in the )ys(ol share4 an% copy the '!3C files to the '!3C store. c. !reate an A(+, store in Active (irectory' and move all your A(+, files to Active (irectory. %. )hare the EsystemrootEFPolicy!efinitions fol%er on all your %omain controllers4 an% set up $as, )che%uler to copy '!3C files automatically from one system to all other systems. 16. /ou ha(e set up roaming profiles for all users in your networ,4 but users are complaining that logon an% logoff ta,e a long time. /ou in(estigate an% arri(e at a solution that %oesn0t reBuire users to change the way they wor, an% can be implemente% Buic,ly. Which solution %i% you most li,ely choose? a. "pgra%e your networ, infrastructure to increase ban%wi%th. b. -orbi% users from storing files in their profile fol%ers. c. Set folder redirection $olicies. %. 2e(ert bac, to nonroaming policies. 19. /ou0re concerne% that some %omain controllers an% wor,stations %on0t meet security reBuirements. What shoul% you %o to (erify security settings on a computer against a list of ,nown settings.create or co$y a security tem$late files and confi%ure the security. 1<. 1one of the computers in an O" seem to be getting computer policies from the GPO lin,e% to the O"4 but users in the O" are getting user policies from this GPO. Which of the following is a possible reason that computer policies in the GPO aren0t affecting the computers? (Choose all that apply.) a. $he GPO lin, is %isable%. #. he !om$uter !onfi%uration settin%s are disa#led. c. he com$uter accounts have (eny Read $ermission. %. $he O" has the >loc, &nheritance option set. 18. /ou nee% to mo(e some user an% computer accounts in 'cti(e !irectory4 but before you %o4 you want to ,now how these accounts will be affecte% by the new group policies they will be sub=ect to. What can you %o? a. 2un )ece%it.eAe. #. Run Grou$ Policy +odelin%. c. 2un Group Policy 2esults. %. 2un 2)oP. 1?. /ou ha(e configure% some group policy preferences on a GPO lin,e% to an O"G this GPO has been wor,ing fine for months. $o test the preferences4 you log on to a Vista computer as a user who shoul% be affecte% by these settings4 but the preferences %on0t appear to ta,e effect. /ou restart the computer an% log on again. 1either the computer

5 nor the user seem to be affecte% by the preference settings. What0s the most li,ely cause of the problem? a. $he "ser Configuration settings are %isable% on the GPO. b. $he GPO lin, is %isable%. c. he GPP !S& $ac"a%e isn/t installed. %. $he user an% computer are security filtere%. #7. /ou want to set a group policy preference that affects only computers with a CP" spee% of at least #.7 GD@. What0s the best way to %o this? a. !onfi%ure item-level tar%etin%. b. 3o(e all computers meeting the criteria into a separate O". c. Configure the group policy client on each computer with this type of CP". %. /ou can0t set this preference. #1. /ou %on0t ha(e policies that force settings for the loo, of users0 computer %es,tops. 5ach user0s chosen %es,top settings are applie% from his or her roaming profile to any computer he or she logs on to. /ou thin, it0s important for users to ha(e this choice4 but you0% li,e a consistent loo, for computers use% for pro%uct %emonstrations to customers. What0s the best way to %o this without affecting users when they log on to other computers? a. Configure %es,top policies in the Computer Configuration no%e of a GPO4 an% lin, this GPO to the O" containing the %emonstration computers. a. !onfi%ure loo$#ac" $olicy $rocessin% in !om$uter !onfi%uration. !onfi%ure the des"to$ settin%s in *ser !onfi%uration' and lin" the GPO to the O* containin% the demonstration com$uters. b. Create a new user name% !emo. Configure !emo0s %es,top settings4 an% use only this user to log on to %emonstration computers. c. Create a new GPO with a startup script that configures %es,top settings appropriate for %emonstration computers when these computers are starte%. in, the GPO to the O" containing the %emonstration computers. &nstruct users to restart %emonstration computers before using them. ##. /ou want to create policies in a new GPO that affects only computers with Win%ows CP installe%. /ou %on0t want to reorgani@e your computer accounts to %o this4 an% you want computers that are upgra%e% to Vista to fall out of the GPO0s scope automatically. What can you %o? a. -or each policy4 use selecti(e application to specify Win%ows CP as the O). b. Create a new O"4 place all computer accounts representing computers with Win%ows CP installe% in this O"4 an% lin, the GPO to this O". c. Create a group calle% CP Computers. Place all computer accounts representing computers with Win%ows CP installe% in this group4 an% use this group in a security filter on the GPO. in, the GPO to the %omain. d. !onfi%ure a 0+I filter on the GPO that s$ecifies 0indows ,P as the OS. Lin" the GPO to the domain.

#*. When a policy setting in Computer Configuration an% "ser Configuration in the same GPO conflict4 the Computer Configuration policy setting ta,es prece%ence. $rue or -alse? #.. /ou0re a consultant for a small company that uses eight Win%ows Vista computers in a wor,group configuration. $he owner as,e% you to set restricti(e policies on users to pre(ent them from ma,ing Control Panel4 %es,top4 an% other changes. $he owner wants to be eAempt from these policies but shoul%n0t be a member of the local '%ministrators group. What shoul% you %o? a. !onfi%ure the Local !om$uter Policy o#)ect' and then confi%ure a users$ecific GPO for the owner. b. Configure the ocal Computer Policy ob=ect4 an% use GPO filtering to eAempt the owner from this policy. c. &nstall Win%ows )er(er #778 an% configure 'cti(e !irectory. '%% the Vista computers to the %omain4 configure a GPO for the %omain4 an% use filtering to eAempt the owner. %. Configure the ocal Computer Policy ob=ect4 an% then configure a logon script for the owner that changes the restricti(e settings. #6. /ou want to ha(e a library of GPOs that specify baseline settings for %ifferent policy categories4 an% you can use this library to create new GPOs with baseline settings alrea%y configure%. What0s the best way to accomplish this? --a starter GPOs for each $olicy is needed in each $olicy cate%ory. *sin% the settin%s in the Starter GPOs as a #aseline to create GPOs.