You are an administrator at ABC.com. Company has a network of 5 member servers acting
as file servers. It has an Active Directory domain.
You have installed a software application on the servers. As soon as the application is
installed, one of the member servers shuts down itself. To trace and rectify the problem, you
create a Group Policy Object (GPO).
You need to change the domain security settings to trace the shutdowns and identify the
cause of it.
What should you do to perform this task?
A.
Link the GPO to the domain and enable System Events option
B.
Link the GPO to the domain and enable Audit Object Access option
C.
Link the GPO to the Domain Controllers and enable Audit Object Access option
D.
Link the GPO to the Domain Controllers and enable Audit Process tracking option
E.
Perform all of the above actions
Explanation:
http://msdn.microsoft.com/en-us/library/ms813610.aspx
Audit system events
Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy
Description Determines whether to audit when a user restarts or shuts down the computer;
or an event has occurred that affects either the system security or the security log.
By default, this value is set to No auditing in the Default Domain Controller Group Policy
object (GPO) and in the local policies of workstations and servers.
If you define this policy setting, you can specify whether to audit successes, audit failures, or
not to audit the event type at all. Success audits generate an audit entry when a system
event is successfully executed. Failure audits generate an audit entry when a system event
is unsuccessfully attempted. You can select No auditing by defining the policy setting and
unchecking Success and Failure.