Your network contains an Active Directory domain named contoso.com. The domain
contains a file server named Server1. The File Server Resource Manager role service is
installed on Server1. All servers run Windows Server 2012 R2.
A Group Policy object (GPO) named GPO1 is linked to the organizational unit (OU) that
contains Server1. The following graphic shows the configured settings in GPO1.
Server1 contains a folder named Folder1. Folder1 is shared as Share1.
You attempt to configure access-denied assistance on Server1, but the Enable accessdenied assistance option cannot be selected from File Server Resource Manager.
You need to ensure that you can configure access-denied assistance on Server1 manually
by using File Server Resource Manager.
Which two actions should you perform?
A.
Set the Enable access-denied assistance on client for all file types policy setting to
Disabled for GPO1.
B.
Set the Customize message for Access Denied errors policy setting to Not Configured for
GPO1.
C.
Set the Enable access-denied assistance on client for all file types policy setting to
Enabled for GPO1.
D.
Set the Customize message for Access Denied errors policy setting to Enabled for GPO1.
Explanation:
Ref: http://technet.microsoft.com/en-us/library/hh831402.aspx
Why sould the GPO be enabled? The questions states “manually configure access-denied assistance with FSRM”. Shouldn’t it be B only instead? (I guess it’s badly worded question and only one answer will be needed in the real exam.)
Check out:
http://technet.microsoft.com/en-us/library/hh831402.aspx#BKMK_1
You need GPO to set the settings by GPO and not in manual mode.
your right Sam..
I think its ‘B’ & ‘D’ as its says choose 2 actions
B. Set the Customize message for Access Denied errors police setting to Not Configured for GPO1.
C. Set the Enable access-denied assistance on client for all file types policy setting to Enabled for GPO1.
You have to set the customise setting to Not Configured or else the settings in the GPO will override the FSRM settings.
… so it has to be “not configured” rather than enabled.
hopefully this helps clear ups somethings
https://technet.microsoft.com/en-us/library/dd759104.aspx
Not Configured is the default state for all policy settings. Policy settings set to Not Configured do not affect users or computers.
Customize message for Access Denied errors-
https://www.vanstechelman.eu/windows-group-policy-encyclopedia/56cb0dd33e636b2ef82c2ad176c51f4c/customize-message-for-access-denied-errors
This policy setting specifies the message that users see when they are denied access to a file or folder. You can customize the Access Denied message to include additional text and links. You can also provide users with the ability to send an email to request access to the file or folder to which they were denied access.If you enable this policy setting users receive a customized Access Denied message from the file servers on which this policy setting is applied. If you disable this policy setting users see a standard Access Denied message that doesn’t provide any of the functionality controlled by this policy setting regardless of the file server configuration.If you do not configure this policy setting users see a standard Access Denied message unless the file server is configured to display the customized Access Denied message. By default users see the standard Access Denied message.
B & D.
Just tested in my lab setup. Doesn’t make much sense, though. “Enable access-denied assistance…” doesn’t really enforce your FSRM to activate custom access denied assistance.
tell the correct answer plzzz ????
hassan, yes is correct.
My guess to this question which is kinda jacked up by the way…almost sounds like local security policy here on the FSRM /File server never the less..
..I believe group policy may interfere with if custom messages policy was enabled and since you want the FSRM to handle the assistance BC would be my answer..according to figure it not configured so it would need to be enabled according to technet article posted..part of assistance would be having a link a user can click on which would be provided by FSRM settings..
tough one guys any suggestions..
For me the answer is B & D (Validate on my LAB)
Correction B & C
b and c
B for sure, as in real life, both gpo’s would be set to “not configured”
Those who says B&D, How do you configure same GPO to “not configured and Enabled”?
Answer should be B and C.
It is B & C.
B: Having the ‘Customize messages for Access Denied errors’ set to Disabled as the exhibit shows is what is causing the option to be grayed out in FSRM. By setting this to Not Configured, you would then have the ability to MANUALLY ENABLE it in FSRM, like the question is stating you should do.
C: ‘Enable access-denied assistance…’ needs to be set to Enabled, as it is outlined in the technet article for configuring this feature. If you only do the first step and not this, access-denied assistance will still not work.
B is correct. However, what’s confusing is both settings can be left on “not configured” and FSRM access denied message can still be configured and will show to the user.
But having both options set to Enabled, the access denied message is greyed out in FSRM. So it can’t be D and with B correct D can’t be correct also as others already pointed out.
With B&C configured, the FSRM option isn’t greyed out so that must be the correct answer.
A can’t be correct since the option to disable it can’t be selected, only Enabled or Not Configured. So if A&D conflict with FSRM only B&C can be correct.
Again, what’s so confusing about this question is both options can be left Not configured in GPO and the FSRM message will still appear to the user. So it does not matter if C
sorry meant to say it doesn’t matter if the option in C is set to enabled.
this question id written incorectly!!!!!! if to do this using group policy the yes answer should ok and correct C and D but here is said using FSRM. then its configured trough the policy setting then in FSRM all is grayed out no changes allowed. To use FSRM manually enough just to set up that disabled to not configured and you are able to set up all things in FSRM then.
Tested on my lab: New gp linked to the domain controllers.
Running FSRM from a domain controller (2012 r2)
Having the policy as shows in the question:
Customize message …. Disabled
Enable access denied assistance … Not configured.
When trying to access the tick case for selecting Enable access-denied assistance
from F S R M Options, Access-Denied Assistance tab, I can not select the option.
If I Enable the first policy : Customize message for Access Denied errors policy setting to Enabled, the other without change (Not configured), the FSRM tab has the Enable accces-denied assistance option ALREADY CHECKED, and if I click on the button View assistance request settings I get another screen, but I can not select Enable users to request assistance
Moreover, In each of the screens under F S R M Options, access-denied assistance tab, I get the warning : “These settings are controlled by Group policy and cannot be changed here”.
If I put both policies to Not Configured (that would be answers Aand B here,
I can customize the message through FSRM.
So, finally, the correct answer, verified 100%, is :
A and B
I’m sorry I have to backtrack.
Answer is not A and B.
In my test, answer would be BOTH POLICIES NOT CONFIGURED.
I’ve tried with some other settings, but none of them work, because, in fact, this f**ing policy seems to be a “2 part policy”, meaning that the ENABLE ACCESS DENIED ….should be set on the client computer (not on the server that is sharing the ressources),as it says in the policy itself (This Group Policy Setting should be set on Windows clients to enable acces-denied assistance for all file types).
This is not what the question says, so I’m at a loss here.
You would set the customize message GPO to not configured then not too sure about the other setting.
But definitely B and either A or C but I would go for C as if you disable the setting it tells me it will not work.
Looking at it again, I think either B and C or the question is incorrect and it is just B.
It’s B & C.
Guys if you look up the setting for ‘enable acces-denied assistance on client for all file types’ you will find that this is something you would set on the client pc and not the server, so I believe the question should only ask for one answer, which would be B.
But all I could think here is B and C if it actually does want 2.
unless the OU also contains the client machines as well as the server.
It says nothing in the question about the client machines being in a different OU
In this case, the top setting would apply to the server and the bottom would apply to the client machines if I am correct?
https://4sysops.com/archives/access-denied-assistance-in-windows-server-2012/
According to this guy, the GPO needs to target both clients AND the fileserver. Which seems fair enough.
Ok since i wasn’t sure about this answer, i tried it in lab.
After applying answer B, the Access-Denied Assistance tab on FSRM is now available, before it was greyed out. So i think you would only need one answer, and in this case would be B. If the real exam asks for 2 answers then i’ll pick B and C, since those 2 answers are the only ones that don’t grey out the Access-Denied Assistance tab on FSRM.
B and C are correct, if you set the “Customize message for access denied errors” policy to Enabled, then you can´t manually configure Access denied assistance in File Server Resource Manager
C and D are correct
https://www.exam-labs.com/exam/70-411 (VERY HELPFUL!!) (Checkout the answer to question 1)