Exam MD-100 topic 3 question 17 discussion

Agreed C. Power Users can manage shares locally, but you'd need Admin to be able to connect to do this remotely.

C. Administrators Network Configuration Operators Members of the Network Configuration Operators group can have the following administrative privileges to manage configuration of networking features: Modify the Transmission Control Protocol/Internet Protocol (TCP/IP) properties for a local area network (LAN) connection, which includes the IP address, the subnet mask, the default gateway, and the name servers. Rename the LAN connections or remote access connections that are available to all the users. Enable or disable a LAN connection. Modify the properties of all remote access connections of users. Delete all the remote access connections of users. Rename all the remote access connections of users. Issue ipconfig, ipconfig /release, and ipconfig /renew commands. Enter the PIN unblock key (PUK) for mobile broadband devices that support a SIM card. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#network-configuration-operators

Members of the Administrators group have full control over the computer, including the ability to remotely create and modify shares on Windows 10 computers. Adding a user to the Administrators group would provide them with the necessary permissions to manage network shares, but it would not follow the principle of least privilege, as this group has more privileges than necessary to manage network shares. If the solution must use the principle of least privilege, then adding the user to the Network Configuration Operators group is a better option, as this group has the necessary permissions to manage network shares while having fewer privileges than the Administrators group. However, if the user needs to have administrative privileges for other reasons, such as installing software or managing system settings, then adding them to the Administrators group may be necessary. In this case, other measures should be taken to limit the user's privileges as much as possible to minimize the risk of security breaches.

Administrators only The other accounts won't work because you will be UAC prompted. The bit doubt here would be using a Remote Management User. This user will have to access WMI resources and those resources also are affected by UAC. There's a lot of learning docs about the subject WMI beginning with the definition about Remote Management Users group. For further studies as I did, I'd recommend you do the same about this interesting group. Start in the link below https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#:~:text=Remote%20Desktop%20Users-,Remote%20Management%20Users,-Replicator

Sorry, I meant Remote Management Users is too restrictive.

It is C. Remote Management Users can use WMIC to create shares, BUT the folder has to already exist AND they need administrative permission to begin with on the remote machine AND they cannot use WMI to change share permissions. D is too restrictive.

I always get misleaded by this statement, "The solution must use the principle of least privilege", and because of this statement I chose B, end up answer C. *Frustrated*

C is correct.

So we have a domain with multiple computers and we want a user to connect remotely on all these computers and create a share, right? The question is vague. To which group should you add the user? Is the user a domain user? The mentioned group is it an AD group or a local group? If we need to add (and/or create) a user to a local group on all the computers (which can be dozens) is stupid. But the answer is correct: Administrators group If we need to add a domain user to a AD group, then the Administrators group is wrong choice, as all the others.

Why Remote Management Users can't do the job?

Note: in Windows 7 and above, Power Users only exists for legacy purposes, and is the same as ordinary Users, unless an admin explicitly adds extra rights to the group. https://serverfault.com/questions/525880/what-does-the-windows-7-local-group-power-users-actually-do

Yes.. the group Power users is present for backwards compatibility.. But the answer is correct C.