You are an Enterprise administrator for contoso.com. The company has a head office and a branch office. The corporate network of the company consists of a single Active Directory domain. All the servers on the network run Windows Server 2008.
The company has four domain administrators and two support technicians, which are located in the head office and the branch office respectively.
Which of the following options would you choose to deploy a new Windows Server 2008 server in the branch office? You want to minimize the security privileges granted to the support technicians. However, you want to ensure that the support technicians are allowed to install server roles and are allowed to stop and start services.
A.
Configure the restricted enrollment agent on the new Windows Server 2008 server and then create a permissions list for the support technicians.
B.
Create a new organizational unit (OU) for the support technicians permission and then assign them the permissions to modify objects in the new OU. Put the new Windows Server 2008 server in the new OU.
C.
Add the support technicians to the Domain Admins group.
D.
Assign the support technicians to the Administrators group on the new Windows Server 2008 server.
E.
None of the above
Explanation:
‘Administrators’ is a local group that provides full administrative access to an individual computer or a single domain, depending on its location. Because this account has complete access, you should be very careful about adding users to this group. To make someone an administrator for a local computer or domain, all you need to do is make that person a member of this group. Only members of the Administrators group can modify this account.
http://www.windowsecurity.com/articles/Securing-Local-Administrators-Group-Every-Desktop.html