You configure a Group Policy Object for the Marketing organizational unit (OU) to prevent users from accessing My Network Places and from running System in Control Panel. You want the Managers domain local group to be able to access My Network Places, but

第1题：

第2题：

You are the network administrator for The network consists of a single Active Directory domain named The domain contains Windows Server 2003 computers and Windows XP Professional computers. The domain contains a group named SalesAdmin. Members of the SalesAdmin group need the permission to add Group Policy links and create Group Policy objects (GPOs) for only the Sales organizational unit (OU). You need to configure the domain to provide the SalesAdmin group with the minimum permissions necessary to meet these requirements. What should you do?（）

• A、Add the SalesAdmins group to the Group Policy Creator Owners group.
• B、Configure the discretionary access control list (DACL) on all of the Group Policy links for the Sales OU to assign the SalesAdmins group the Allow - Apply Group Policy permission.
• C、Run the Delegation of Control wizard on the domain to assign the SalesAdmin group the Manage Group Policy links task.
• D、Run the Delegation of Control wizard on the Sales OU to assign the SalesAdmins group the Manage Group Policy links task.

第3题：

第4题：

Your network consists of Windows XP computers. All computers are joined to a single Active  Directory directory service domain and located in a single Active Directory site. You create a new Group  Policy object （GPO） and link it to the site. The policy configures default screensaver settings. User  accounts of users in the research department are located in an organizational unit （OU） named Research.  You need to allow users in the research department to configure a different screensaver setting on their  computers.  What should you do？（）

• A、 Move the user accounts of users in the research department to the Users container.
• B、 Configure a local security policy on all computers in the research department to allow users to modify their screensaver settings.
• C、 Add users in the research department to a domain group. Allow the group the Apply Group Policy permission for the GPO.
• D、 Add users in the research department to a domain group. Deny the group the Apply Group Policy permission to the GPO.

第5题：

You are the network administrator for your company. Your network consists of a single Active   Directory domain. Three security groups named Accountants， Processors， and Management are located in an organizational unit （OU） named Accounting. All of the user accounts that belong to these three  groups are also in the Accounting OU. You create a Group Policy object （GPO） and link it to the  Accounting OU. You configure the GPO to disable the display options under the User Configuration  section of the GPO. You need to achieve the following goals： You need to ensure that the GPO applies to  all user accounts that are members of the Processors group. You need to prevent the GPO fromapplying  to any user account that is a member of the Accountants group. You need to prevent the GPO from  applying to any user account that is a member of the Management group， unless the user account is also  a member of the Processors group. What should you do？（）

• A、 Modify the discretionary access control list （DACL） settings of the GPO to assign the Accountants and Management security groups the Deny - Read and the Deny - Apply Group Policy permissions. Modify the DACL of the GPO to assign the users who are in both the Accountants and Management security groups the Allow - Read and the Allow - Apply Group Policy permissions.
• B、 Modify the discretionary access control list （DACL） settings of the GPO to assign the Accountants and Management security groups the Deny - Read and the Deny - Apply Group Policy permissions. Create a new security group named Mixed that contains all the user accounts from the Processors group and the specific user accounts from the Management group to which you want the GPO to apply. Modify the DACL of the GPO to assign the Mixed security group the Allow - Read and the Allow - Apply Group Policy permissions.
• C、 Modify the discretionary access control list （DACL） settings of the GPO to assign the Accountants security group the Deny - Read and the Deny - Apply Group Policy permissions. Modify the DACL settings of the GPO to remove the Authenticated Users special group. Modify the DACL settings of the GPO to add the Processors group and assign the Allow - Read and the Allow - Apply Group Policy permissions.
• D、 Modify the discretionary access control list （DACL） settings of the GPO to assign the Accountants security group the Deny - Read and the Allow - Apply Group Policy permissions. Modify the DACL settings of the GPO to assign the Management security group the Deny - Read and the Deny - Apply Group Policy permissions.

第6题：

第7题：

Your network consists of a single Active Directory domain. User accounts for engineering department  are located in an OU named Engineering.    You need to create a password policy for the engineering department that is different from your domain  password policy.    What should you do（）

• A、Create a new GPO. Link the GPO to the Engineering OU.
• B、Create a new GPO. Link the GPO to the domain. Block policy inheritance on all OUs except for the  Engineering OU.
• C、Create a global security group and add all the user accounts for the engineering department to the  group. Create a new Password Policy Object （PSO） and apply it to the group.
• D、Create a domain local security group and add all the user accounts for the engineering department to  the group. From the Active Directory Users and Computer console， select the group and run the  Delegation of Control Wizard.

第8题：

第9题：

Your company has an Active Directory domain that has an organizational unit named Sales. The   Sales organizational unit contains two global security groups named sales managers and sales  executives.    You need to apply desktop restrictions to the sales executives group. You must not apply these desktop  restrictions to the sales managers group. You create a GPO named DesktopLockdown and link it to the  Sales organizational unit.   What should you do next（）

• A、Configure the Deny Apply Group Policy permission for the sales managers on the DesktopLockdown  GPO.
• B、Configure the Deny Apply Group Policy permission for the sales executives on the DesktopLockdown  GPO.
• C、Configure the Deny Apply Group Policy permission for Authenticated Users on the DesktopLockdown  GPO.
• D、Configure the Allow Apply Group Policy permission for Authenticated Users on the DesktopLockdown  GPO.

第10题：

Your network consists of a single Active Directory domain. The domain contains 13 member servers. The member servers run Windows Server 2003 Service Pack 2 (SP2). The computer accounts for all member servers are located in an organizational unit (OU) named Servers. You need to prevent remote desktop connections to the member servers. What should you do? （）

• A、On each server, remove all users from the Remote Desktop Users group.
• B、On each server, run the Terminal Services Configuration console. From the RDP-TCP connection permissions properties, set the Full Control permission for the Remote Desktop Users group to deny.
• C、Use a Group Policy Object (GPO) to disable the Allow users to connect remotely using Terminal Services setting.
• D、Use a Group Policy Object (GPO) to configure the Sets rules for remote control of Terminal Services user sessions setting to No Remote Control.