Administering Windows Server 2012 — Question 54
Your network contains an Active Directory domain named contoso.com.
You create a new user account named Admin5.
You need to ensure that Admin5 can create Group Policy objects (GPOs) and link the GPOs to all of the organizational units (OUs) in the domain. Admin5 must be prevented from modifying GPOs created by other administrators.
Which two actions should you perform? (Each correct answer presents part of the solution. Choose two.)
Answer options
- A. From Active Directory Users and Computers, modify the members of the Network Configuration Operators group.
- B. From Active Directory Users and Computers, modify the Security settings of the Admin5 user account.
- C. From Group Policy Management, click the Group Policy Objects node and modify the Delegation settings.
- D. From Group Policy Management, click the contoso.com node and modify the Delegation settings.
- E. From Active Directory Users and Computers, modify the members of the Group Policy Creator Owners group.
Correct answer: C, D
Explanation
The correct actions are C and D because modifying the Delegation settings in both the Group Policy Objects node and the contoso.com node allows Admin5 to create and link GPOs while restricting modifications to existing GPOs. Options A, B, and E do not provide the necessary permissions for GPO management and linking, nor do they address the requirement of restricting Admin5's ability to alter GPOs created by others.