Your network contains an Active Directory domain named contoso.com. All domain controllers run either
Windows Server 2008 or Windows Server 2008 R2.
You deploy a new domain controller named DC1 that runs Windows Server 2012 R2.
You log on to DC1 by using an account that is a member of the Domain Admins group.
You discover that you cannot create Password Settings objects (PSOs) by using Active Directory Administrative
Center.
You need to ensure that you can create PSOs from Active Directory Administrative Center.
What should you do?
A.
Modify the membership of the Group Policy Creator Owners group.
B.
Transfer the PDC emulator operations master role to DC1.
C.
Upgrade all of the domain controllers that run Window Server 2008.
D.
Raise the functional level of the domain.
Explanation:
Fine-grained password policies allow you to specify multiple password policies within a single domain so that
you can apply different restrictions for password and account lockout policies to different sets of users in a
domain. To use a fine-grained password policy, your domain functional level must be at least Windows Server
2008. To enable fine-grained password policies, you first create a Password Settings Object (PSO). You then
configure the same settings that you configure for the password and account lockout policies. You can create
and apply PSOs in the Windows Server 2012 environment by using the Active Directory Administrative Center
(ADAC) or Windows PowerShell.
Step 1: Create a PSO
Applies To: Windows Server 2008, Windows Server 2008 R2
http: //technet. microsoft. com/en-us//library/cc754461%28v=ws. 10%29. aspx
you need to upgrade your 2008 servers.
PSO requires 2008 R2 (yes it can run on 2008 but a lot of functionality is lost and PowerShell is a no go without at least 2008 R2)
I’d go with D. To enable fine grained policies the domain functional level should be at least 2008 and PDC Emulator role should be located on a DC with at least Windows 2008. Functional level in the questioned domain seems to be lower then 2008.
Fine grained password policy is availble in all versions of server 2008. See this link https://technet.microsoft.com/en-us/library/cc770394(v=ws.10).aspx
I would also say answer is D
In order to raise the domain functional level to 2008R2, you must upgrade or retire all DCs running 2008.
they did not state what the functional level is! But I’d assume it’s *below* 2008
That(!) is why you received the error message. M$ wants you to be aware of the difference from HAVING a 2008 (R2) server AND forest/domain FUNCTIONAL levels. (you also have to prep your AD (which is a database it is NOT a DC) before you can raise functional levels).
lets be clear. windows 2008 or later functional level is fine. the question doesnt state what functional level it is only that it can accommodate 2008 or above. we are getting an error message so we need to assume the domain is below 2008 functional level. answer is correct
Raise the functional level of the domain.
I think that the best answer is : Raise the functional level of the domain.