Exam 70-742 topic 1 question 181 discussion

Users in the Domain Admins and Enterprise Admins groups can perform all Group Policy management tasks. Users that are members of the Group Policy Creator Owners domain group can create GPOs. They also have the right to edit and delete any GPOs that they have created. If you want to delegate the ability for users to create GPOs, you can add them to the Group Policy Creator Owners group. You can also explicitly grant them permission to create GPOs using the GPMC. The question doesn't specify anything about the groups to which the user belongs or the permissions it has so in my opinion, the correct answer is A. https://www.microsoftpressstore.com/articles/article.aspx?p=2217265&seqNum=2

As the majority of users have said, it's A. We have to assume User1 is a standard user as no other permissions have been assigned. They have full control over that OU, but it doesn't mean they have additional rights in the rest of the domain. They need to be GPO Creator/Editor group to have more control. As they don't, they can only link to the OU.

By default, the ability to create a GPO is only for Domain Administrators, Enterprise Administrators, Group Policy Creator Owners, and SYSTEM. See the link. https://serverfault.com/questions/514513/permission-to-create-gpos#:~:text=1%20Answer&text=From%20TechNet%3A,create%20new%20Group%20Policy%20objects. So the option of 'Create a GPO in this domain and Link it here' will be seen only if you are part of any of those groups. Having full permission on OU only gives you option to 'Link an existing GPO'. So in my opinion, answer is A.

When you try to delegate full permission to OU there is only "Manage Group Policy links" option, so user cannot create but can link. answer is A

You can't assign full control on an OU on delegate permissions....when you go properties of an OU you only get General, Managed by and COM+ tabs.

Answer is correct

The answer is correct and tested on the lab

Answer is A

I’m very sorry guy, I was high when I post my comment; please disregards the previous statement; B is correct answer

Full control permission to OU1 Will not give the permission to link the GPO, therefore A is correct answer, you must be deligated or be a domain controller to link GPO

A is correct answer, if you want to link GPO you must assign delegation or you are a domain admin, given full permission doesn’t mean you have all administration rights

I have tested it. The correct answer is B.

User1 has Full control on the OU1, User1 can create and link a GPO to OU1. The answer is B.