Exam MD-102 topic 1 question 112 discussion

C. an account protection policy https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices

✅ Correct exam answer: D. Device Configuration Profile It's the fully supported, general availability (GA) method to add a user to the Remote Desktop Users group. C (Account Protection Policy) can also work, but it's still in preview, and Microsoft exams typically avoid preview features. Use a Device Configuration Profile with the Settings Catalog or Custom OMA-URI to configure local group membership. https://learn.microsoft.com/en-us/mem/intune/configuration/local-users-groups-settings-windows

To add User1 to the Remote Desktop Users group on the Windows 11 devices, you would use a device configuration profile in Microsoft Intune. Specifically, you can configure a Group Policy Object (GPO) or use a custom configuration profile to add User1 to the Remote Desktop Users group across multiple devices. This approach ensures the policy is applied to all relevant devices in the marketing department.

account protection policy isn't the correct choice in this scenario. Account protection policies in Intune are generally used to configure security-related settings, such as enforcing password policies or managing Windows Hello for Business.

A Device Configuration Profile provides a way to manage device settings, including adding users or groups to local device groups like Remote Desktop Users.

https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices

C good

Device configuration profiles are used to configure settings on managed devices.In this case, you need to modify a specific setting (adding a user to a group) on multiple devices.This allows you to define this setting and push it out to the targeted devices (in this case, the marketing department's Windows 11 devices).

A device configuration profile in Microsoft Intune allows you to manage various settings on Windows 11 devices, including user permissions. By creating a device configuration profile, you can specify settings to automatically add User1 to the Remote Desktop Users group on all targeted devices. Steps to Configure a Device Configuration Profile: *Sign in to the Microsoft Intune admin center. *Select Devices > Configuration profiles > Create profile. *Platform: Choose Windows 10 and later. *Profile type: Select Custom. *Configuration settings: Use OMA-URI settings to configure the membership of the Remote Desktop Users group.

Account Protection section in Endpoint Security has the policy for exactly this purpose. We use this to create users in local Admin groups when making LAPS policies.

D To add User1 to the Remote Desktop Users group on each marketing department device, you should configure a device configuration profile. Device configuration profiles in Microsoft Intune allow you to define and push settings to managed devices. In this case, you can use a device configuration profile to manage the built-in group memberships on devices, including the Remote Desktop Users group. This will allow User1 to provide remote support for the devices in the marketing department.

D. A device configuration profile in Intune allows you to manage settings and configurations on the devices, including adding users to specific local groups such as the Remote Desktop Users group. You can create a custom profile to automate this task across all the relevant devices.

D is the answer To add User1 to the Remote Desktop Users group on each marketing department device running Windows 11, you should configure a device configuration profile. This profile allows you to manage settings and configurations on devices enrolled in Microsoft Intune. Here’s how you can achieve this using PowerShell: Manual Process: Open Computer Management. Click the Action menu. Select Connect to Another Computer. Type the Computer Name (e.g., “Computer1”). Click OK. Expand Local Users and Groups

c is correct

Should be C idd. https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#:~:text=Local%20user%20group%20membership%20(preview)%20%E2%80%93%20Use,Manage%20local%20groups%20on%20Windows%20devices.

C is correct Still in preview, but Tried in my tenant https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-account-protection-policy#manage-local-groups-on-windows-devices

C. an account protection policy Ref: https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-administrator-privileges-using-microsoft-entra-groups-preview:~:text=Organizations%20can%20use%20Intune%20to%20manage%20these%20policies%20using%20Custom%20OMA%2DURI%20Settings%20or%20Account%20protection%20policy.