Mcsa - 70-218 - Windows 2000 Network Environment - Chapter 9

Front 1

What is the least and most influencial of all GPOs?

Back 1

The local group policy is the least and the Organizational Unit (OU) is the greatest.
L S D OU (least to most)

Front 2

What permissions are necessary for a group to delegate control of a GPO?

Back 2

Read and Write.

Front 3

What is the format of a Group Policy's name?

Back 3

[GivenName] [DCname.domainname] Policy
Example: IT logon [dc1.semcogdom.local] Policy

Front 4

What GP settings are found in both the computerand user configuration settings?

Back 4

Software Settings
Windows Settings
Administrative Templates

Front 5

Desribe the difference between "assigning" and "publishing" applications via GP.

Back 5

Assigning installs the application whereas publishing makes it available. You cannot publish to a computer; only a user.

Front 6

In Group Policies, what are the two items under Windows Settings that are under both Computers and Users?

Back 6

Scripts and Security Settings.

Front 7

What scripting languages work in GP?

Back 7

VBScript, JScript, Perl, and MS-DOS batch (.bat and .cmd) files.

Front 8

The settings under Administrative Templates that are common to both Computers and Users are?

Back 8

Windows Components
System
Network.

Front 9

Where in the registry are the Administrative Template settings kept for Computers and Users?

Back 9

Computers: HKLM - HKEY_LOCAL_MACHINE.
Users: HKCU - HKEY_CURRENT_USER

Front 10

What two services start as the computer boots to obtain an ordered list of GPOs?

Back 10

Remote Procedure Call System Service (RPCSS) and
Multiple Universal Naming Convention Provider (MUP)

Front 11

What if two GPs have conflicting settings and both are set to "No Override"?

Back 11

The GP hiest in the Active Directory hierarch takes precedence.

Front 12

To where is the Block Policy Inheritance applied? To the GPO, to the GPO link or to hte Site, domain or OU?

Back 12

Block Policy Inheritance is applied to the entire Site, domain or OU, thus deflecting all GP settings that reach it.

Front 13

In Active Directory, what is Loopback?

Back 13

An exception in the order GPs are applied. Often used for Kiosks, laboratories and classrooms.

Front 14

In the order of GPs being applied, what is the Replace mode?

Back 14

Computer GPOs replace the user GPOs.

Front 15

Which GPs prevail, an inherited GP or an explicitly applied GP?

Back 15

Explicitly applied GP.

Front 16

Are "not configured" settings passed on to child containers?

Back 16

No. Enabled and disabled are.

Front 17

What are the default permissions of Authenticated Users in GPOs?

Back 17

Read, Apply Group Policy, Special Permissions

Front 18

What are teh default permissions of Creator Owner in GPOs?

Back 18

Special Permissions

Front 19

Of the GPOs linked to a location, what order are they processed in and which ones have the highest priority?

Back 19

The highest priority is the GPO at the top. The processing starts at the bottom and may be overridden by subsequent GPOs.

Front 20

Where do you configure the Loopback setting?

Back 20

In the settings of the GPO itself. Computers > Administrative Templates > System > Group Policy > "Use Group Policy Loopback processing mode."

Front 21

What are the two modes of the Loopback Processing Mode?

Back 21

Replace: Replaces the user settings with the computer settings.
Merge: Appends the group policy at logon with the startup computer policy.

Front 22

If you want to filter out a GPO so it does not apply to some user/group, what, besides the obvious "Apply Group Policy", do you select "Deny"?

Back 22

Read

Front 23

List "Employing Group Policy Best Practices", p 318

Back 23

1. Disable unused portions of Goup Policy, Computer or User.
2. Avoice regualr use of Block Policy Inheritance and No Override. Make troubleshooting more complicated.
3. Minimize the number of GPOs applied to users and computers. Slows down boot process.
4. Filter policies based on security group membership. These users/groups do not process those GPOs.

Front 24

There are 5 security groups by default for each new GPO. List them and their permissions.

Back 24

1. Authenticted Users - Read & Apply Group Policy.
2. Creator Owner - None. All blank. Special Permissions all apply to child objects
3. Domain Admins - All but Full and Apply Group Policy
4. Enterprise Admins - Same as above.
5. System - Same as above.

Front 25

In User Configuration, what is the only Security Setting that can be set?

Back 25

To Create a Certificate Trust list.

Front 26

Under Computer Configuration, the security settings are broken down into 9 areas. What are they?

Back 26

1. Account Policies.
2. Local Policies.
3. Event Log.
4. Restricted Groups.
5. System Services.
6. Registry Services.
7. File System.
8. Public Key Policies.
9. IP Security Policies.

Front 27

Why should you not configure account policies for OUs that do not contain any computers?

Back 27

Because account policies are only in the Computer Configuration section.

Front 28

Why is there a minimum password age setting?

Back 28

Because combined with the "Enforce Password History" it prevents users from circumventing the Maximum Password Age policy.

Front 29

What are the requirements of the "Passwords Must Meet Complexity Requirements"?

Back 29

The password must contain at least one of each of the following: uppercase, lowercase, numbers, and symbols (!@#, etc.)

Front 30

Can a user be added to a group even though their name is not in the Restricted Groups list?

Back 30

Yes, but the next time that Group Policies are applied, they will be removed.

Front 31

What is the purpose of Registry under the Security Settings of the Computer Configuration?

Back 31

Allows you to set access permissions for registry keys and file system elements. It does not change the registry settings.

Front 32

What are the three policies found under "IP Security Policies on Active Directory"?

Back 32

1. Client (Respond Only) Computer supports but never initiates IPSec communication.
2. Secure Server (Require Security). Computer can only communicate using IPSec.
3. Server (Request Security). A computer attempts to initiate IPSec communication, but can still support unsecured communication if necessary.

Front 33

What is the old and the current command line commands for refreshing the GPOs?

Back 33

Old: Secedit /refreshpolicy Machine_policy and user_policy.
Current: gpupdate.

Front 34

When an administrator tries to open a GPO and receives the message "Failed to Open the Group Policy Object, what is the root cause?

Back 34

A failure in DNS.

Front 35

What is the role of membership in security groups play in the administration of GPOs?

Back 35

This is used ONLY for filtering. A user or computer MUST be in at least one security group that has the Read permission set to Allow and one security group that has the Apply Group Policy permission set to allow. The application of a GPO must come from the linking to a site, a domain or an Organizational Unit.

Front 36

Which takes precedence, "Block Policy Inheritance" or "No Override"?

Back 36

"No Override" wins.

Front 37

How do you apply a GPO which is in a container that is not a Site, Domain or OU?

Back 37

By linking it to an OU which is a parent of the container.

Front 38

Why do shortcuts of a program which Windows Installer uninstalled, still appear on the desktop?

Back 38

Because those were placed there by the user and the program has no knowledge of them.