Exam 70-742 topic 1 question 185 discussion

Actual exam question from Microsoft's 70-742

Question #: 185
Topic #: 1

HOTSPOT -
Your network contains an Active Directory forest named fabrikam.com. The forest contains three domains named fabrikam.com, sales.fabrikam.com, and contoso.com.
You recently added a site named Europe.
The forest contains four users who are members of the groups shown in the following table.

You need to create a Group Policy object (GPO) named GPO1 and to link GPO1 to the Europe site.
Which users can perform each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

by MrRiver at Nov. 9, 2019, 1:52 p.m.

Comments

Submit Cancel

Trifon

4 years, 5 months ago

I would say any domain admin can create a GPO in his domain, so part 1: all 4 users. Part 2: The Sites node is on the same lavel as the Domains node in Group Policy Management, not below the Domains. Meaning a Site is not "part of" any domain, as has been suggested here. But it is below the Forest node, so only the Enterprise Admin and the Domain Admin of the root domain can link a GPO here, meaning users 1 and 2.

upvoted 2 times

...

jam7272

4 years, 8 months ago

"The Create a GPO in this domain, and link it here option is not available for sites. The administrator can create a GPO in any domain in the forest, and then use the Link an Existing GPO option to link it to the site."... note the words, 'can create a GPO in ANY domain in the forest'. That means all 4 can create the GPO. Agreed that only 1 and 2 can link it.

upvoted 3 times

...

VeiN

4 years, 8 months ago

The answer is correct. Although you can create GPO1 anywhere it needs to exist in root Domain. And there only user 1 and 2 can create it. Sites can be only created and managed from root Domain (and link GPOs. So only user 1 and 2 has access there.

upvoted 1 times

alexnt

4 years, 8 months ago

So you mean that user 3 and 4 cannot create any gpo in their own domains, because it doesn't say if gpo must be created in a specific domain.

upvoted 2 times

...

Nhan

5 years, 3 months ago

the given answer is correct because user1 & user2 is the admin for the forest level, user 3 is child domain admin and user4 is a tree domain admin, in this case only user1 & user2 is have forest admin privilege.

upvoted 1 times

...

MrRiver

5 years, 7 months ago

the second part ist correct ... only enterprise Admins and Domains Admins of the Root domain can link GPO's to sites. Secend Part should be: all 4 users Every Domain Admin can Create Gpo's in his own domain. If you richt click on sites (in GPMC) it says "link an existing gpo ..." There you can choose a GPO from all existing domains. This could also be a GPO that a domain admin of child domain has created. This by the way explains why the Site GPO is process before the default domain policy.

upvoted 2 times

dittrichdimitri

5 years, 6 months ago

The answer is correct! It's 1 and 2 in both! By default, Domain Administrators have GPO linking permission for domains and OUs, and Enterprise Administrators and Domain Administrators for the forest root domain can manage links to sites. So the second answer would be User1, User2 and user4, however there is probably a missing part of the question where the new Europe site belongs to the domain Fabrikam.com, so the correct answer is user1 and User2 which are the only users that belong to Fabrikam.com Root domain. Taking this into account, the first part's answer is User1 and User2 can only create GPO1 as it will be linked to the EUROPE site that is part of the Fabrikam.com root domain, and also because both "Domain Admins" and "Enterprise Admins" can link GPOs. It is important to always remember that Create, Edit, and Link permissions are separate / independent.

upvoted 18 times

Aimismyname

4 years, 7 months ago

Please refer to section 'Additional Considerations': https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789193(v=ws.11) GPO1 can be created in any domain, but only the User1 and User2 can link it to the site. So all 4 users can create GPO1.

upvoted 3 times

...