B35 70-640 Active Directory Group Policy Part One

Front 1

Abbrev : GPOs

Back 1

Group Policy objects

Front 2

Abbrev : GPMC

Back 2

Group Policy Management Console

Front 3

GPME

Back 3

Group Policy Management Editor

Front 4

Policy Setting states ?

Back 4

A policy setting can have three states:

Not Configured,
Enabled,
and Disabled.

Front 5

A single GPO can be linked to more than one site or OU.

Back 5

A single GPO can be linked to more than one site or OU.

Front 6

What is the Scope of the GPO : Security Filters ?

Back 6

You can narrow the <b>scope of the GPO<\b> with one of two types of filters:

Security Filters that specify global security groups to which the GPO should or should not apply.

Front 7

WMI

Back 7

Windows Management Instrumentation

Front 8

What do Windows Management Instrumentation (WMI) filters do for the scope of a GPO ?

Back 8

Windows Management Instrumentation (WMI) filters that specify a scope,
using characteristics of a system such as operating system version or free disk space.

Front 9

Abbrev : RSoP ?

Back 9

Resultant Set of Policy

Front 10

What is the Resultant Set of Policy (RSoP) ?

Back 10

Users or Computers are likely to be within the scope of multiple GPOs linked to the sites, domain, or OUs in which the users or computers exist.

This leads to the possibility that policy settings might be configured differently in multiple GPOs.

You must be able to understand and evaluate the Resultant Set of Policy (RSoP), which determines the settings that are applied by a client when the settings are configured divergently in more than one GPO.

Front 11

Refresh settings for Policy settings in the Computer Configuration node ?

Back 11

Policy settings in the Computer Configuration node are applied at
system startup and every 90–120 minutes thereafter.

Front 12

Policy Refresh settings User Configuration policy settings ?

Back 12

User Configuration policy settings are
applied at logon and every 90–120 minutes thereafter.

Front 13

Manual Refresh of Group policy settings is done using ?

Back 13

gpupdate.exe
/force
/logoff
/target: { computer | user }
/wait: value
/boot

Front 14

What are the tools associated with Group Policy Updation ?

Back 14

Gpupdate
Secedit
FLEX COMMAND

FLEX COMMAND: Help in group updates of workstation. It can be applied directly to OUs etc

Front 15

Abbrev : CSEs

Back 15

Client-Side Extensions

Front 16

Security settings are reapplied every 16 hours even if a GPO has not changed.

Back 16

Security settings are reapplied every 16 hours even if a GPO has not changed.

Front 17

Always Wait For Network At Startup And Logon policy setting

Back 17

Without this setting, by default, Windows XP and Windows Vista clients perform only background refreshes, meaning that a client might start up and a user might log on without receiving the latest policies from the domain.

Front 18

GPSI

Back 18

Group Policy Software Installation

Front 19

startup,logon, logoff, and shutdown scripts will not run
if the user is disconnected from the Enterprise Network.

Back 19

startup,logon, logoff, and shutdown scripts will not run
if the user is disconnected from the Enterprise Network.

Front 20

If a user is disconnected from the Enterprise network does group policy still apply itself ?

Back 20

Yes, The previously applied group policy settings are still applied.

Front 21

The local GPO exists whether or not
the computer is part of domain, workgroup,
or a non-networked environment.

Back 21

The local GPO exists whether or not
the computer is part of domain, workgroup,
or a non-networked environment.

Front 22

By default, only the Security Settings policies
are configured on a system’s local GPO.

All other policies are set at Not Configured

Back 22

By default, only the Security Settings policies
are configured on a system’s local GPO.

All other policies are set at Not Configured

Front 23

When AD DS is installed,
two default GPOs are created

■ Default Domain Policy
■ Default Domain Controllers Policy

Back 23

■ Default Domain Policy : This GPO is linked to the domain and has no security group or WMI filters.

■ Default Domain Controllers Policy : This GPO is linked to the Domain Controllers OU. Because computer accounts for domain controllers are kept exclusively in the Domain Controllers OU, and other computer accounts should be kept in other OUs, this GPO affects only domain controllers.

Front 24

Abbrev: GUID ?

Back 24

globally unique identifier

Front 25

By default, when Group Policy refresh occurs, the CSEs apply settings in a GPO only if the GPO has been updated

Back 25

By default, when Group Policy refresh occurs, the CSEs apply settings in a GPO only if the
GPO has been updated

Front 26

Describe the default Group Policy processing behavior, including refresh intervals and CSE application of policy settings

Back 26

Every 90–120 minutes, the Group Policy Client service determines which GPOs are scoped to the user or computer and downloads any GPOs that have been updated, based on the GPOs’ version numbers.

CSEs process the policies in the GPOs according to their policy processing configuration.

By default, most CSEs apply policy settings only if a GPO has been updated.

Some CSEs also do not apply settings if a slow link is detected.

Front 27

Abbrev : DRA

Back 27

Directory Replication Agent

Front 28

Group Policy Storage ?

Back 28

The GPC is an Active Directory object stored in the Group Policy Objects container
within the domain naming context of the directory. Like all Active Directory objects, each GPC
includes a globally unique identifier (GUID) attribute that uniquely identifies the object
within Active Directory. The GPC defines basic attributes of the GPO, but it does not contain
any of the settings. The settings are contained in the GPT, a collection of files stored in the SYSVOL
of each domain controller in the %SystemRoot%\SYSVOL\Domain\Policies\GPO GUID
path, where GPO GUID is the GUID of the GPC. When you make changes to the settings of a
GPO, the changes are saved to the GPT of the server from which the GPO was opened

Front 29

Scripting Languages that can be used to write code for Group Policy in Windows Server 2008

Back 29

Microsoft Visual Basic, Scripting Edition (VBScript), Microsoft JScript, Perl, and Microsoft MS DOS style batch files (.bat and .cmd).

Front 30

GPO is actually two components: a
Group Policy Container (GPC)
and Group Policy Template (GPT)

Back 30

GPO is actually two components: a
Group Policy Container (GPC)
and Group Policy Template (GPT)

Front 31

Abbrev : KCC

Back 31

Knowledge Consistency Checker

Front 32

How is Group Policy Container GPC of GPO replicated ?

Back 32

The GPC in Active Directory is replicated by the Directory Replication Agent (DRA) using a topology generated by the Knowledge Consistency Checker (KCC).

Front 33

The GPT in the SYSVOL is replicated using one of two technologies.

The File Replication Servicev(FRS) is used to replicate SYSVOL in domains running Windows Server 2008, Windows
Server 2003, and Windows 2000.

If all domain controllers are running Windows Server 2008, you can configure SYSVOL replication, using Distributed File System Replication (DFS-R), a much more efficient and robust mechanism.

Back 33

The GPT in the SYSVOL is replicated using one of two technologies.

The File Replication Servicev(FRS) is used to replicate SYSVOL in domains running Windows Server 2008, Windows
Server 2003, and Windows 2000.

If all domain controllers are running Windows Server 2008,
you can configure SYSVOL replication, using Distributed File System Replication (DFS-R), a much more efficient and robust mechanism.

Front 34

What does the Group Policy Verification Tool Gpotool.exe do ?

Back 34

Gpotool.exe is used to troubleshoot GPO status,
including problems caused by the replication
of GPOs, leading to inconsistent versions of a GPC and GPT

Front 35

In both the Computer Configuration and User Configuration nodes,
the Administrative Templates node contains
registry-based Group Policy settings.

Back 35

In both the Computer Configuration and User Configuration nodes,
the Administrative Templates node contains
registry-based Group Policy settings.

Front 36

Policies in the Administrative Templates node in the Computer Configuration node modify
registry values in the HKEY_LOCAL_MACHINE (HKLM) k

Back 36

Policies in the Administrative Templates node in the Computer Configuration node modify
registry values in the HKEY_LOCAL_MACHINE (HKLM) k

Front 37

Policies in the Administrative Templates node in the
User Configuration node modify registry values in the HKEY_CURRENT_USER (HKCU) key.

Back 37

Policies in the Administrative Templates node in the
User Configuration node modify registry values in the HKEY_CURRENT_USER (HKCU) key.

Front 38

ADM and ADMX/ADML administrative templates can coexist.
These are administrative templates files

Back 38

ADM and ADMX/ADML administrative templates can coexist.
These are administrative templates files

Front 39

Another new Group Policy feature in Windows Server 2008 is starter GPOs.
A starter GPO contains Administrative Template settings

Back 39

Another new Group Policy feature in Windows Server 2008 is starter GPOs.
A starter GPO contains Administrative Template settings

Front 40

Starter GPOs can contain only Administrative Templates policy settings.

Back 40

Starter GPOs can contain only Administrative Templates policy settings.

Front 41

You can centralize the management of administrative templates by creating a central store

Back 41

You can centralize the management of administrative templates by creating a central store

Front 42

Windows Server 2008 also adds the ability to attach comments to GPOs and policy settings

Back 42

Windows Server 2008 also adds the ability to attach comments to GPOs and policy settings

Front 43

1. Litware, Inc., has three business units,
each represented by an OU in the litwareinc.com domain.
The business unit administrators want the ability to manage Group Policy for the users and computers in their OUs. Which actions do you perform to give the administrators the ability to manage Group Policy fully for their business units? (Choose all
that apply. Each correct answer is a part of the solution.)

A. Copy administrative templates from the central store to the Policy Definitions folder on the administrators’ Windows Vista workstations.

B. Add business unit administrators to the Group Policy Creator Owners group.

C. Delegate Link GPOs permission to the administrators in the litwareinc.com domain.

D. Delegate Link GPOs permission to the each business unit’s administrators in the business unit’s OU.

Back 43

1. Correct Answers: B and D

A. Incorrect: The central store is used to centralize administrative templates so that they do not have to be maintained on administrators’ workstations.

B. Correct: To create GPOs, the business unit administrators must have permission to access the Group Policy Objects container. By default, the Group Policy Creator Owners group has permission, so adding the administrators to this group will
allow them to create new GPOs.

C. Incorrect: Business unit administrators require permission to link GPOs only to their business unit OU, not to the entire domain. Therefore, delegating permission to link GPOs to the domain grants too much permission to the administrators.

D. Correct: After creating a GPO, business unit administrators must be able to scope the GPO to users and computers in their OU; therefore, they must have the Link GPOs permission.

Front 44

You are an administrator at Contoso, Ltd.
The contoso.com domain has a child domain,
es.contoso.com, for the branch in Spain.
Administrators of that domain have asked you to
provide a Spanish-language interface for Group Policy Management Editor. How can youprovide Spanish-language versions of administrative templates?

A. Log on to a domain controller in the es.contoso.com domain, open %SystemRoot%
\SYSVOL\domain\Policies\PolicyDefinitions, and copy the ADM files to the ESfolder.

B. Copy ADML files to the \\es.contoso.com\SYSVOL\es.contoso.com\policies\PolicyDefinitions\es folder.

C. Log on to a domain controller in the es.contoso.com domain, open %System-
Root%\SYSVOL\domain\Policies\PolicyDefinitions, and copy the ADMX files to the ES folder.

D. Install the Boot.wim file from the Windows Server 2008 CD on a domain controller in the child domain.

Front 45

You are an administrator at Contoso, Ltd. At a recent conference, you had a conversation
with administrators at Fabrikam, Inc. You discussed a particularly successful set of configurations
you have deployed using a GPO. The Fabrikam administrators have asked
you to copy the GPO to their domain. Which steps can you and the Fabrikam administrators
perform?
A. Right-click the Contoso GPO and choose Save Report. Create a GPO in the Fabrikam
domain, right-click it, and choose Import.
B. Right-click the Contoso GPO and choose Back Up. Right-click the Group Policy
Objects container in the Fabrikam domain and choose Restore From Backup.
C. Right-click the Contoso GPO and choose Back Up. Create a GPO in the Fabrikam
domain, right-click it, and choose Paste.
D. Right-click the Contoso GPO and choose Back Up. Create a GPO in the Fabrikam
domain, right-click it, and choose Import Settings.

Back 45

Correct Answer: D
A. Incorrect: A saved report is an HTML or XML description of a GPO and its settings.
It cannot be imported into another GPO.
B. Incorrect: The Restore From Backup command is used to restore a GPO in its
entirety.
C. Incorrect: You cannot paste settings into a GPO.
D. Correct: You can import settings to an existing GPO from the backed-up settings
of another GPO.