Mcsa - 70-218 - Windows 2000 Network Environment - Chapter 8

Front 1

Differentiate between permissions and rights.

Back 1

Rights apply to user accounts.

Permissions apply to object properties.

Front 2

What are Domain Local Groups most often used for?

Back 2

To assign permissions to network resources.

Front 3

What are Global Groups most often used for?

Back 3

To group users who share the same network access requirements.

Front 4

What are Universal Groups most often used for?

Back 4

To assign permissions that span more than one domain.

Front 5

Be careful not to confuse Domain Local Groups with what?

Back 5

Local Groups that reside only on individual computers, most often used in workgroups, but can be used with domain computers.

Front 6

What are the four steps in the recommended strategy for using Domain Local Groups and Global Groups?

Back 6

1. Assign users with common access requirments to a global group.
2. Create a Domain Local Group that will be added to a resource for permissions.
3. Add the global group to the designated Domain Local Group.
4. Assign resouce permissions of the group to the Domain Local Group.

Front 7

What are two non-recommended strategies often used and their limitations?

Back 7

1. Placing users, rather than groups, into the Domain Local Group. Limitation: Does not allow permissions for resources outside the domain.
2. Placing user accounts in global groups and assigning permission to the global groups, rather than to Local Domain Groups. Limitations: Becomes complicated to administer when network grows beyond one domain.

Front 8

Two guidelines for using Universal Groups.

Back 8

1. Use like Domain Local Groups, but for permissions to groups/users from more than one domain.
2. Only use when membership is relatively static, due to excessive network traffic replicating information.

Front 9

What are the four categories of default groups in W2K?

Back 9

1. Pre-defined.
2. Built-in.
3. Built-in local.
4. Special identity.

Front 10

Pre-defined groups are found where?

Back 10

In the Users folder. (Note: this is not an Organizational Unit and cannot be assigned Group Policies.

Front 11

How can you use pre-defined groups?

Back 11

1. Pre-defined groups do not have any inherited rights or permissions.
2. You can assign rights or permissions to them by either assigning rights directly to them or by placing them as members of a Local Domain Group.

Front 12

List the four pre-defined groups and what built-in groups they are automatically added to.

Back 12

1. Domain Admins. Domain admins are automatically added to the Administrators built-in domain local group.
2.Domain Guest. Automatically added to the Guests bilt-in domain local group.
3. Domain Users. Automatically added to the Users built-in domain local group.
4. Enterprise Admins. May be added to the Administrators domain local group of each domain.

Front 13

What kind of groups are "built-in" groups? Global Groups, Domain Local Groups, or Universal Groups?

Back 13

They are pre-defined Domain Local Groups. Placing a user or group into these gives them the permissions and rights on the Domain Controllers and Active Directory.

Front 14

Describe the rights and permissions of the built-in group Account Operators.

Back 14

They can create, delte and modify user and group objects, but not modify the Administrator's group or any operators groups.

Front 15

Describe the rights and permissions of the built-in group Administrators.

Back 15

Can perform all admin tasks on DCs and the domain. Domain Admins and Enterprise Admins groups are members.

Front 16

Describe the rights and permissions of the built-in group Backup Operators

Back 16

Self-explanatory.

Front 17

Describe the rights and permissions of the built-in group Guests and it's members.

Back 17

Only permissions you give it. Cannot make permanent changes to the desktop environment. Members include IUSR_computername, IWAM_computername, and TsInternetUser user accounts and Domain Guests.

Front 18

Define the IUSR_computername user account.

Back 18

The IUSR_computername account is used by IIS to grant anonymous access to Web resources.

Front 19

Define the IWAM_computername user account.

Back 19

IWAM_computername is the account used by Microsoft Transaction Server (MTS) and various IIS entities to provide programmatic and transactional functions.

Front 20

Describe the Replicator built-in group.

Back 20

For replication services (of course!). The only member should be a domain user account used to log on to the Replicator services. Do not add account of actual users.

Front 21

What are the rights of the Server Operators built-in group?

Back 21

Share disk resources and back up and restore files on the DC.

Front 22

What are two unique characteristics of "Special Identity Groups"?

Back 22

1. You cannot modify their permissions.
2. You cannot see them when you administer groups.

Front 23

List 7 Special Identity Groups and describe their purpose.

Back 23

1. Anonymous Logon. Any user that Windows does not authenticate.
2. Authenticated Users. Contains all valid user accounts. Use in place of the Everyone group to prevent anonymous access to resources.
3. Dialup. Anyone who currently has a dialup connection.
4. Everyone. Anyone who accesses a computer.
5. Interactive. Includes any user who is currently logged on to the physical computer (not remote).
6. Creator Owner. Includes the creator or owner of the resource in question. If an administrator creates a resource, the administrator's group becomes the owner.
7. Network. Any user with a remote connection to the resource in question.

Front 24

A Power User is a predefined, built-in, built-in local, or special identity?

Back 24

Built-in local.

Front 25

Domain Admins are a predefined, built-in, built-in local, or special identity?

Back 25

Predefined.

Front 26

Account Operators are a predefined, built-in, built-in local, or special identity?

Back 26

Built-in.

Front 27

You can change the type of a grou only when?

Back 27

When Windows 2000 is operating in Native mode.

Front 28

A global group can be changed into a __________ group only if?

Back 28

universal group
Only if the global group is not nested in another global group.

Front 29

A domain local group can be change into a __________ group only if?

Back 29

universal group
Only if the dlg is not nested in another dlg.

Front 30

What security level should an administrator normally run in and what privilidges does it give him/her?

Back 30

Users group or Power Users group. Users group allows for normal routine tasks. Power Users group can also install programs, add printers and use most Control Panel tools.

Front 31

If the "Run as" program doesn't work, what is the likely cause?

Back 31

The RunAs service isn't running.

Front 32

Give the "RunAs" command line syntax.

Back 32

Runas /user:<adminname>@<computername> <programname> or
Runas /user:<computername>\<adminname> <program>