70-413: Chapter 27 & 28

Front 1

Allows you to perform fine-grained delegation to enable administration of specific object attibutes

Back 1

Delegation of Control Wizard

• You first you need specify the type of AD object to delegate, and then you need to delegate the custom tasks associated with the object.

Front 2

These tools allow an administrator to manage Windows Server 2012 from a client platform.

Back 2

RSAT (Administration Tools)

• PowerShell cmdlets and modules that correspond to the RSAT tools are also part of this installation.
  
• The client machine simply need to download the RSAT installation via Windows Update Standalone installer file

Front 3

This special process protects certain objects from being directly modified in Active Directory.

Back 3

AdminSDHolder

• To configure permissions on the AdminSDHolder object, open ADSI Edit, choose the Default naming context, and navigate to the CN=System node under the domain in which you should find CN=AdminSDHolder.
• The AdminSDHolder object has a unique Access Control List (ACL), which is used to control the permissions of security principals that are members of built-in privileged Active Directory groups.
  
• As previously noted, AdminSDHolder permissions apply to security principals that belong to protected groups.
  

Front 4

Is a function in Active Directory that enables a computer,typically a server, to authenticate with a user’s credentials.

Back 4

Kerberos constrained delegation

• This is a method for services to perform authentication on behalf of users.
• 
  

Front 5

This PowerShell CMDlet allows to view a list of security principals allowed to perform delegated authentication

Back 5

Get-ADComputer, Get-ADServiceAccount, or Get-ADUser cmdlets with the -Propertiesparameter set to PrincipalsAllowedToDelegateToAccount

Front 6

To configure a service to enable specific security principals to perform delegated authentication, use?

Back 6

New-ADComputer,New-ADServiceAccount, New-ADUser, Set-ADComputer, Set-ADServiceAccount, orSet-ADUser cmdlets with the -PrincipalsAllowedToDelegateToAccount parameter.

Front 7

Each domain has hundreds of users who are to be classified in three separate categories, and administrators should have restrictions on the actions they can perform on each user type:

How could you meet the requirement of restricting access to user objects basedon the type of user?

Back 7

By placing each user class in its own OU, you can delegate different permissions toeach type of user.

Front 8

Each domain has hundreds of users who are to be classified in three separate categories, and administrators should have restrictions on the actions they can perform on each user type:

Local administrators should be able to create new objects within their domain,but the number of objects they create should be closely monitored. With whatmethod could you accomplish this goal?

Back 8

Active Directory quotas meet this requirement perfectly.

Front 9

Each domain has hundreds of users who are to be classified in three separate categories, and administrators should have restrictions on the actions they can perform on each user type:

A very select group of corporate administrators should be able to manage membership of highly restricted groups throughout the forest, including the Enterprise Admins group. How would you allow access to this group to perform these duties?

Back 9

Creating a security group containing these corporate administrators and giving thempermissions over the AdminSDHolder gives the appropriate permissions over theserestricted groups.

Front 10

Each domain has hundreds of users who are to be classified in three separate categories, and administrators should have restrictions on the actions they can perform on each user type:

A local administrator cannot create any new objects in his domain due to thenumber he has already created. How could you allow this user to continuecreating new objects?

Back 10

There are two solutions:

1. Increase the user’s quota.
   
2. Change the owner of the objects that were created by the user.
   

Front 11

What methods can you use to configure permissions on an object in Active Directory?

Back 11

• Editing the Security tab directly enables you to configure Active Directory object permissions.
  
• The Delegation of Control Wizard provides quick and easy access to setpermissions on an object in Active Directory.
  

Front 12

Which of the following determines a user’s quota when all apply?

Back 12

Group-assigned quota of 1000

Front 13

Which command sets the quota for members of the HelpDesk group to 100 objects?

Back 13

The DSADD quota command is used to assign a quota to a security principal, either a user or a security group.

Front 14

What actions might fail due to quota limitations?

Back 14

Domain migrations create or update large numbers of objects in the target domain.

The user performing the migration should not be constrained by quotas.

Front 15

What additional step must be taken after installing RSAT for Windows 8.1 to make theadmin tools available?

Back 15

Installing RSAT should be the only step needed to gain access to thetools.

Front 16

6. How can you assign permissions to a protected admin group in Active Directory suchas Enterprise Admins?

Back 16

Modifying the ACL on the AdminSDHolder object results in the object’s ACL being configured correctly.

Front 17

With what tool do you configure permissions on the AdminSDHolder object?

Back 17

ADSI Edit should be used to configure permissions on the AdminSDHolder object. 8.

Front 18

8. Why would you need to create or manage a Kerberos delegation?

Back 18

Delegations enable a computer to authenticate as a user.

Front 19

9. What capability in Kerberos constrained delegation is available beginning in WindowsServer 2012?

Back 19

Limiting Kerberos constrained delegation to individual services is a newfeature in Windows Server 2012.