Exam MD-101 topic 2 question 16 discussion

The domain GPO exists, but would not be considered as correct, because it dont specify that drivers could not be installed via Windows Update. It prevents that drivers can be installed in every way possible. Maybe this is why it's not the best option. The Domain GPO can be found in: Group Policy Management Editor > Default Domain Policy>Computer Configuration>Policies>Administrative Templates>System>Device Installation Restrictions

I think this should be A: Yes, it is possible to do it this way, and the referenced url only states another way to achive the same goal, not that it is incorrect

Answer is Yes, that is one way to prevent the video drivers from being updated automatically by Windows Update. By using the Group Policy object (GPO) and configuring the Prevent installation of devices using drivers that match these device setup classes setting, you can block the installation of specific device drivers based on their device GUID. To find the device GUID for your video driver, you can follow these steps: Open the Device Manager by right-clicking on the Start menu button and selecting Device Manager. Find your video driver under the Display adapters section. Right-click on the video driver and select Properties. Go to the Details tab and select Device instance path from the drop-down menu. The device GUID should be displayed in the Value field. Once you have the device GUID, you can use it to configure the Prevent installation of devices using drivers that match these device setup classes setting in the GPO to prevent Windows Update from updating the video driver automatically.

A, This solution would meet the goal of preventing the video drivers from being updated automatically by using Windows Update. By enabling the Prevent installation of devices using drivers that match these device setup classes setting in a Group Policy object and specifying the device GUID, you can prevent the specified devices from being updated or installed through Windows Update. This can be useful in situations where specialized hardware or software is in use and you want to ensure that updates do not cause compatibility issues or disrupt the functioning of the system.

I've done this before for network drivers that have caused issues.

Source: https://docs.microsoft.com/en-us/windows/client-management/manage-device-installation-with-group-policy "When you use device Classes to allow or prevent users from installing drivers, you must specify the GUIDs for all of the device's device setup classes, or you might not achieve the results you want. The installation might fail (if you want it to succeed) or it might succeed (if you want it to fail)." This means you should use GUIDs if you want to "prevent users from installing drivers"...I pick "A) Yes" as correct answer

The question is 'updated automatically' not 'installed'. That GPO would prevent any installation, even manual.

Prevent installation of devices that match these device IDs This policy setting specifies a list of Plug and Play hardware IDs and compatible IDs for devices that users cannot install. If you enable this policy setting, users cannot install or update the driver for a device if its hardware ID or compatible ID matches one in this list. If you disable or do not configure this policy setting, users can install devices and update their drivers, as permitted by other policy settings for device installation. Note: This policy setting takes precedence over any other policy settings that allow users to install a device. This policy setting prevents users from installing a device even if it matches another policy setting that would allow installation of that device.

It does fulfill it's purpose, although it's a bit extreme to do it this way.

The GPO that the provided solution is referring to: https://docs.microsoft.com/en-us/windows/client-management/manage-device-installation-with-group-policy VS The correct resolve: https://docs.microsoft.com/en-us/windows/deployment/update/waas-wu-settings

Answer A:Yes

"Prevent installation of devices using drivers that match these device setup classes" is different from "Prevent installation of devices that match any of these device IDs". The first only accepts ClassGUIDs (f.e. ALL graphics cards), while the latter only accepts DeviceGUIDs (f.e. specific graphics card). Dropping a device GUID in the GPO for device setup classes will not work imho. So the answer is no for me. https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.DeviceInstallation::DeviceInstall_Classes_Deny https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.DeviceInstallation::DeviceInstall_IDs_Deny https://docs.microsoft.com/en-us/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors

If you specify the GUID, it's correct!

The answer is YES! This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings.

This should A. Checked from the MS doc: This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.

Yes this obviously meets the goal. It is also the only way to specifically limit installation of specific types of drivers (such as video drivers) vs just setting windows update to not update any drivers (which would also meet the goal, but not update any other drivers). This is an important distinction in that one might want windows update to update other drivers. This is the only way to do that.

The device is already installed, configuring device installation restrictions won't make a difference. We need to stop driver updates from Windows Update.