Your company has a single Active Directory domain. You have 30 database servers that run Windows
Server 2008 R2. The computer accounts for the database servers are stored in an organizational unit
(OU) named Data. The user accounts for the database administrators are stored in an OU named
Admin. The database administrators are members of a global group named D_Admins. You must
allow the database administrators to perform administrative tasks on the database servers. You
must prevent the database administrators from performing administrative tasks on other servers.
What should you do?
A.
Deploy a Group Policy to the Data OU.
B.
Deploy a Group Policy to the Admin OU.
C.
Add D_Admins to the Domain Admins global group.
D.
Add D_Admins to the Server Operators built-in local group.
Explanation:
http ://technet.microsoft.com/en-us/library/cc754948%28WS.10%29.aspx
Group Policy Planning and Deployment Guide
You can use Windows Server 2008 Group Policy to manage configurations for groups of computers
and users, including options for registry-based policy settings, security settings, software
deployment, scripts, folder redirection, and preferences. Group Policy preferences, new in Windows
Server 2008, are more than 20 Group Policy extensions that expand the range of configurable policy
settings within a Group Policy object (GPO). In contrast to Group Policy settings, preferences are not
enforced. Users can change preferences after initial deployment. For information about Group Policy
Preferences, see Group Policy Preferences Overview.
Using Group Policy, you can significantly reduce an organization’s total cost of ownership. Various
factors, such as the large number of policy settings available, the interaction between multiple
policies, and inheritance options, can make Group Policy design complex. By carefully planning,
designing, testing, and deploying a solution based on your organization’s business requirements, you
can provide the standardized functionality, security, and management control that your organization
needs.
Overview of Group Policy
Group Policy enables Active Directory–based change and configuration management of user and
computer settings on computers running Windows Server 2008, Windows Vista, Windows Server
2003, and Windows XP. In addition to using Group Policy to define configurations for groups of users
and computers, you can also use Group Policy to help manage server computers, by configuring
many server-specific operational and security settings.
By using a structure in which OUs contain homogeneous objects, such as either user or computer
objects but not both, you can easily disable those sections of a GPO that do not apply to a particular
type of object. This approach to OU design, illustrated in Figure 1, reduces complexity and improves
the speed at which Group Policy is applied. Keep in mind that GPOs linked to the higher layers of the
OU structure are inherited by default, which reduces the need to duplicate GPOs or to link a GPO to
multiple containers.
When designing your Active Directory structure, the most important considerations are ease of
administration and delegation.
