MS 70-640

A. Correct: A password is required so that it can be assigned to the local Administrator account on the server after AD DS is removed.
B. Incorrect: SERVER02 is currently a domain controller, and you are logged on as Administrator. Therefore, you already have the credentials required to perform the
demotion operation.
C. Incorrect: SERVER02 is currently a domain controller, and you are logged on as Administrator. Therefore, you already have the credentials required to perform the
demotion operation. The Domain Controllers group contains computer accounts for domain controllers.

A. Incorrect: There is no native cmdlet in Windows PowerShell for creating users.
B. Incorrect: The SetInfo method commits a new user and its properties to Active Directory, but it must be used in conjunction with commands that create the object and its attributes. It cannot be used as a single command.
C. Incorrect: A container, such as an OU or domain, provides a Create method to create objects of a specified class, but until the SetInfo method is used, the object is not saved to Active Directory. Therefore, Create is not sufficient as a single command.
D. Correct: The Dsadd command can create a user with a single command.

A. Incorrect: An Active Directory task, whether performed using command-line commands, scripts, or remote server administration tools, can be performed by any user who has been delegated permission to the task.
B. Incorrect: Domain Admins are members of the Administrators group in the domain, so any permissions assigned to Administrators would also be assigned to you as a member of the Domain Admins group.
C. Incorrect: The ability to delete an OU or any object in Active Directory is related to permissions, not to ownership.
D. Correct: New organizational units are created with protection from deletion. You must remove the protection before deleting the OU. Protection can be removed using the Active Directory Users And Computers snap-in, with Advanced Features view, on the Object tab of an OU’s properties dialog box.

A. Incorrect: Dsadd creates new objects, including computer objects, but does not join a computer to the account.
B. Correct: Netdom Join can join the local computer or a remote computer to the domain
C. Incorrect: Dctest tests various components of a domain controller.
D. Incorrect: System.cpl is the System Properties control panel application. It enables you to join the local computer to a domain, but not to join a remote computer to a
domain.

A. Incorrect: A down arrow indicates that computer accounts are disabled. It is not necessary to reset the accounts.
B. Incorrect: A down arrow indicates that computer accounts are already disabled.
C. Correct: A down arrow indicates that the accounts are disabled. You need to enable them.
D. Incorrect: A down arrow indicates that computer accounts are disabled. It is not necessary to delete the accounts.

A. Correct: A domain controller will create or join an Active Directory domain, which must have a valid DNS name.
B. Correct: A domain must have a NetBIOS name to support earlier applications that use NetBIOS names.
C. Incorrect: A DHCP server is not necessary. In fact, a domain controller should have statically assigned IP addresses.
D. Incorrect: Although a DNS server is required for the functionality of a domain, if a DNS server does not exist, the Active Directory Installation

A. Incorrect: The Active Directory snap-in in Server Manager, if launched, will be run with the same credentials as the custom console. An Access Denied error will continue to occur.
B. Incorrect: Although dsa.msc is a shortcut to opening the Active Directory Users And Computers console, it will be run with the same credentials as the custom console. An Access Denied error will continue to occur.
C. Correct: An Access Denied error indicates that your credentials are not sufficient to perform the requested action. The question indicates that you are certain that you have permission. The answer introduces the assumption that you have a secondary account. Even though that account is not the Administrator, it is administrative. This is the best answer to the question.
D. Incorrect: DSMOD USER with the –p switch can be used to reset a user’s password; however, the question is targeting the Access Denied error. There is no suggestion that the command prompt was launched with different credentials; therefore, you will continue to receive Access Denied errors.

A. Correct: Computer restrictions limit the computers that a user can log on to. On the Account tab of her user account, you can click the Log On To button and add the computer by name to the list of allowed workstations.
B. Incorrect: When a computer account is created, you can control who is allowed to join the computer to the domain with this button, but it has nothing to do with who can log on to the computer after it is a domain member.
C. Incorrect: Dsmove is used to move an object in Active Directory.
D. Incorrect: Although the user right to log on locally is required, the error message that she reports is not the message that would be received if she did not have the right to log on locally.

A. Incorrect: AD CS is not supported on Server Core.
B. Incorrect: AD FS is not supported on Server Core.
C. Incorrect: AD RMS is not supported on Server Core.
D. Correct: AD CS is not supported on Server Core, so you must reinstall the server with the full installation of Windows Server 2008.

A. Incorrect: Although a user account template will enable you to copy several dozen attributes of it to a new user account, you would have to copy the template 2,000 times to complete this task.
B. Incorrect: The LDIFDE command imports objects from LDIF files, which are not the format natively managed by Microsoft Office Excel.
C. Correct: The CSVDE command imports objects from comma-delimited text files. Excel can open, edit, and save these files.
D. Incorrect: The Dsadd command enables you to create a user from the command line, but you would need to run the command 2,000 times to complete your task.

A. Correct: Such events are symptomatic of a broken secure channel. Resetting the computer’s account is the correct step to take to address the issue.
B. Incorrect: The event does not reflect user authentication problems.
C. Incorrect: Disabling the server account will prevent the server from authenticating. Enabling it will not fix the problem.
D. Incorrect: The event does not reflect user authentication problems.

A. Incorrect: Universal security groups cannot contain users or groups from trusted external domains. They can contain users, global groups, and other universal groups from any domain in the forest.
B. Correct: Domain local security groups can contain members from trusted external domains.
C. Incorrect: Global security groups cannot contain users or groups from trusted external domains. They can contain users and other global groups from the same domain only.
D. Incorrect: Distribution groups cannot be assigned permissions to resources.

A. Incorrect: The Members tab of the group enables you to add and remove members but not to delegate the administration of membership.
B. Incorrect: The Security tab of Mike Danseglio’s user object determines who is delegated the ability to perform tasks on his object, not what Mike is able to do.
C. Incorrect: The Member Of tab of Mike Danseglio’s user object determines the groups to which Mike belongs, not the groups to which Mike has been delegated control.
D. Correct: The Managed By tab of a group enables you to specify

A. Correct: CSVDE can import one or more computers from a .csv file, and Excel can save a worksheet as a .csv file.
B. Incorrect: LDIFDE can import one or more computers, but the LDIF format cannot be created using Excel.
C. Incorrect: Dsadd enables you to create computer objects one at a time.
D. Correct: Windows PowerShell enables you to use ADSI to create computers and can use a .csv file as a data source.
E. Correct: VBScript enables you to use ADSI to create computers and can use a .csv file as a data source.

A. Incorrect: Local Security Policy enables you to configure the settings on a single server.
B. Incorrect: Security Configuration And Analysis enables you to create security templates that can be imported into a GPO, but the tool is not role-based. The Security Configuration Wizard is a better answer.
C. Correct: The Security Configuration Wizard creates role-based security policies that manage services, firewall rules, and audit policies as well as certain registry settings.
D. Incorrect: Security Templates enables you to create security templates that can be imported into a GPO, but the tool is not role-based. The Security Configuration Wizard is a better answer.

A. Correct: LDIFDE supports adding, modifying, or deleting Active Directory objects.
B. Incorrect: Dsmod modifies properties of an existing object.
C. Incorrect: DEL is a command that erases a file.
D. Incorrect: CSVDE can import users but cannot delete them.

A. Incorrect: Local Security Policy enables you to configure the settings on a single server.
B. Correct: You can use Security Configuration And Analysis to compare the test environment configuration to a template, to reconcile discrepancies, and to export the resulting settings to a security template. The security template can then be imported into a GPO.
C. Incorrect: The Security Configuration Wizard does not manage user rights.
D. Incorrect: The Security Templates snap-in can create a security template but cannot export the settings of the test environment server. Security Configuration And Analysis is a better answer.

A. Incorrect: There is no native cmdlet in Windows PowerShell for creating users.
B. Incorrect: ADSI does not provide a NewUser method.
C. Correct: A container, such as an OU or domain, provides a Create method to create objects of a specified class.
D. Incorrect: This is VBScript syntax, recognizable by its use of the Set statement.

A. Incorrect: Dsrm deletes a group. Deleting a group will not solve the problem.
B. Correct: You can use Dsmod with the –scope switch to change the scope of GroupA to a universal group, then to a global group. You will then be able to add GroupA to GroupB. This is a tricky question. Sometimes questions are not quite what they appear to be about on the surface. This question was not about using commands or even about adding one group to another—it was about group scope.
C. Incorrect: Dsquery searches Active Directory for objects. It cannot make a change, so it will not solve the problem.
D. Incorrect: Dsget retrieves an attribute of an object. It cannot make a change, so it will not solve the problem.

A. Incorrect: A saved report is an HTML or XML description of a GPO and its settings. It cannot be imported into another GPO.
B. Incorrect: The Restore From Backup command is used to restore a GPO in its entirety.
C. Incorrect: You cannot paste settings into a GPO.
D. Correct: You can import settings to an existing GPO from the backed-up settings of another GPO.

A. Incorrect: The team members already have permission. This permission will not prevent them from accessing the folder from other computers.
B. Incorrect: The team members already have permission. This permission will not prevent them from accessing the folder from other computers.
C. Incorrect: This permission will not prevent users from accessing the folder from other computers.
D. Correct: A Deny permission overrides Allow permissions. If a team member attempts to connect to the folder from another computer, he or she will be a member of the Network special identity group and will be denied access. If the same team member logs on locally to the conference room computer, he will be a member of Interactive and not Network, so the permissions assigned to him as a member of the team will allow access.

A. Incorrect: Dsmove is a command-line utility that moves existing objects in Active Directory. It does not control the default location for new objects.
B. Incorrect: Move-Item is a Windows PowerShell cmdlet that moves existing objects in a namespace.
C. Inorrect: Netdom is a command-line utility that enables you to join a domain, rename a computer, and perform other computer-related activities, but it does not control the default location for new computers.
D. Correct: Redircmp is a command-line utility that redirects the default computer container to an alternate OU.

A. Correct: The ms-DS-MachineAccountQuota attribute of the domain by default allows all authenticated users the ability to join ten computers to the domain. This
quota is checked when a user is joining a computer to the domain without a prestaged account. Set this attribute to zero.
B. Incorrect: This attribute configures the default quota for all Active Directory objects, not just for new computer accounts.
C. Incorrect: Removing this user right does not prevent Authenticated Users from joining computers to the domain.
D. Incorrect: Setting this permission will prevent all users, including administrators, from creating computer accounts.

A. Incorrect: The group is a distribution group, which cannot be assigned permission. Changing the scope will not address that limitation.
B. Incorrect: The group is a distribution group, which cannot be assigned permission. Changing the scope will not address that limitation.
C. Incorrect: The group is a distribution group. Adding it to the Domain Users group will not enable its members to access the shared folder.
D. Correct: The –secgrp yes switch will change the group type to a security group, after which you can add it to the ACL of the shared folder.

A. Incorrect: You can use the Ctrl key to multiselect users, but they must be in a single OU. The ten users in this scenario are in different OUs.
B. Incorrect: Dsmod will enable you to change the Office property, but Dsget will not locate the objects. Dsget is used to display attributes, not locate objects.
C. Correct: You can use the Dsquery command to identify users whose Office property is set to Miammi and pipe the results to the Dsmod command to change the Office property.
D. Incorrect: These cmdlets are not used with Active Directory objects.

A. Incorrect: Account Operators does not have the right to shut down a domain controller.
B. Correct: Print Operators has the right to shut down a domain controller.
C. Correct: Backup Operators has the right to shut down a domain controller.
D. Correct: Server Operators has the right to shut down a domain controller.
E. Incorrect: The Interactive special identity group does not have the right to shut down a domain controller.

A. Correct: Gpresult.exe produces an RSoP report that will indicate when the GPO was applied. Screen saver policy settings are user configuration settings, so you must run Gpresult.exe for user settings.
B. Incorrect: There is no –computer option for the Gpresult.exe command.
C. Incorrect: Screen saver settings are user, not computer, configuration.
D. Incorrect: Gpupdate.exe is used to trigger a policy refresh, not to report policy application

A. Incorrect: The Group Policy Modeling Wizard is used to simulate Group Policy application, not to report its actual application.
B. Correct: The Group Policy Results Wizard can be used to report Group Policy application on a remote system.
C. Incorrect: Gpupdate.exe is used to initiate a manual policy refresh.
D. Correct: Gpresult.exe can be used with the /s switch to gather RSoP information remotely.
E. Incorrect: Msconfig.exe is used to gather system information and to control system startup.

A. Incorrect: Get-Members is a Windows PowerShell cmdlet that gets the members of an programmatic object, not of a group.
B. Incorrect: Dsquery queries Active Directory for objects matching a search filter. It does not list group membership.
C. Incorrect: LDIFDE can be used to export a group and thereby its members, but only direct members.
D. Correct: Dsget can return an attribute of an object, including the member attribute of group objects. With the expand option, Dsget can return the full membership of
a group.

A. Correct: An object is created by invoking the Create method of a container such as an OU.
B. Correct: The SetInfo method commits a new user and its properties to Active Directory. If the SetInfo method is not used, the new object and changes to its properties occur in your local representation of the object only.
C. Incorrect: This code is invalid. It is similar to code that would be used in VBScript, though not in the creation of user objects.
D. Correct: You must connect to the container in which the user will be created.

A. Correct: Assigning an administrative task requires modifying the DACL of an object such as an OU. The Advanced Security Settings dialog box provides the most direct access to the permissions in the DACL. The Delegation of Control Wizard masks the complexities of object ACEs by stepping you through the assignment of permissions to groups. DSACLS can be used to manage Active Directory permissions from the command prompt.
B. Correct: Assigning an administrative task requires modifying the DACL of an object such as an OU. The Advanced Security Settings dialog box provides the most direct access to the permissions in the DACL. The Delegation of Control Wizard masks the complexities of object ACEs by stepping you through the assignment of permissions to groups. DSACLS can be used to manage Active Directory permissions from the command prompt.
C. Incorrect: DSUTIL is used to manage the domain and directory service properties but is not used to manage object permissions.
D. Correct: Assigning an administrative task requires modifying the DACL of an object such as an OU. The Advanced Security Settings dialog box provides the most direct access to the permissions in the DACL. The Delegation of Control Wizard masks the complexities of object ACEs by stepping you through the assignment of permissions to groups. DSACLS can be used to manage Active Directory permissions from the command prompt.

A. Incorrect: The central store is used to centralize administrative templates so that they do not have to be maintained on administrators’ workstations.
B. Correct: To create GPOs, the business unit administrators must have permission to access the Group Policy Objects container. By default, the Group Policy Creator Owners group has permission, so adding the administrators to this group will allow them to create new GPOs.
C. Incorrect: Business unit administrators require permission to link GPOs only to their business unit OU, not to the entire domain. Therefore, delegating permission
to link GPOs to the domain grants too much permission to the administrators.
D. Correct: After creating a GPO, business unit administrators must be able to scope the GPO to users and computers in their OU; therefore, they must have the Link
GPOs permission.

A. Incorrect: Deleting the computer account will cause its SID to be removed and its group memberships to be lost. You will be forced to add the new account to the same groups and to assign permissions to the new account.
B. Incorrect: Creating a new account for the new system creates a new SID. Permissions will have to be reassigned and group memberships re-created.
C. Correct: Resetting the computer account makes it available for a system to join the domain using the account. The account’s SID and group memberships are
preserved.
D. Correct: You must rename the account so that it can be joined by the new system using its name.
E. Correct: After resetting and renaming the account, you must join the new system to the domain.

A. Correct: In Active Directory Users And Computers, you can right-click the root node of the snap-in or the domain, and you will find the Raise Domain Functional Level command.
B. Incorrect: Active Directory Schema is not used to raise the domain functional level.
C. Incorrect: Active Directory Sites And Services is not used to raise the domain functional level.
D. Correct: You can right-click the domain in the Active Directory Domains And Trusts snap-in and choose Raise Domain Functional Level.

A. Incorrect: If you configure a domain to block inheritance, GPOs linked to sites will not be applied to users or computers in the domain. The Northwind Lockdown
GPO is linked to the domain and will apply to all users, including those in the Domain Admins group.
B. Correct: By blocking inheritance on the OU that contains all the users in the Domain Admins group, you prevent the policy settings from applying to those users.
C. Correct: The Deny Apply Group Policy permission, assigned to Domain Admins, exempts Domain Admins from the scope of the GPO, which otherwise applies to the Authenticated Users group.
D. Incorrect: All user accounts in the domain belong to the Domain Users group as their primary group. Therefore, the GPO will apply to all users, including those in the Domain Admins group.

A. Incorrect: Move-Item is a valid Windows PowerShell cmdlet that moves objects in a namespace, but Windows PowerShell does not yet expose Active Directory as a namespace.
B. Correct: VBScript uses the MoveHere method of a container to move a user to the container.
C. Correct: You can use the Dsmove command to move an object in Active Directory.
D. Incorrect: The Redirusr.exe command is used to configure Active Directory so that new user objects created without specifying an OU will go to a container other than the default Users container.
E. Incorrect: The Active Directory Migration Tool is used to migrate accounts between domains.

A. Correct: Because the desktop restrictions are in the User Configuration node but are being applied when users log on to specific computers, loopback policy processing
is required.
B. Incorrect: Linking the GPO to the OU containing user accounts causes the restrictions to apply to all users at all times, not only when they log on to conference and
training room systems.
C. Incorrect: The Block Inheritance option is not necessary and will prevent the application of all other GPOs from parent OUs, from the domain, and from sites.
D. Correct: To scope the GPO correctly, you must link it to the OU containing the computer objects of conference and training room systems.

A. Correct: The local Administrator account is a default member of Administrators. It cannot be removed.
B. Correct: Domain Admins is added to Administrators when a computer joins the domain. The Member Of policy settings add specified groups to Administrators
and do not remove existing members.
C. Correct: Sydney Support is added to the Administrators group by the Sydney Support GPO. The Member Of policy settings add specified groups to Administrators
and do not remove existing members.
D. Correct: Help Desk is added to the Administrators group by the Corporate Help Desk GPO. The Member Of policy settings add specified groups to Administrators
and do not remove existing members.
E. Incorrect: The Remote Desktop Users group is not a default member of Administrators and is not added to Administrators by any of the GPOs.

A. Incorrect: Global groups cannot contain global groups from other domains.
B. Correct: Global groups can contain users in the same forest.
C. Correct: Global groups can contain users in trusted domains.
D. Correct: Global groups can contain users in the same domain.
E. Correct: Global groups can contain global groups in the same domain.

A. Correct: The local Administrator account is a default member of Administrators. It cannot be removed.
B. Incorrect: Domain Admins is added to Administrators when a computer joins the domain but is removed by the Sydney Support GPO, which specifies the authoritative
membership of the group.
C. Correct: Sydney Support is added to the Administrators group by the Sydney Support GPO.
D. Incorrect: Help Desk is specified as a member of the Administrators group by the Corporate Help Desk GPO, but the Sydney Support GPO has higher precedence
because it is linked to the OU in which DESKTOP234 exists. Therefore, the membership specified by the Sydney Support GPO’s Members Of This Group setting is authoritative.
E. Incorrect: The Remote Desktop Users group is not a default member of Administrators and is not added to Administrators by any of the GPOs.

A. Correct: The local Administrator account is a default member of Administrators. It cannot be removed.
B. Incorrect: Domain Admins is added to Administrators when a computer joins the domain but is removed by the Corporate Help Desk GPO, which specifies the membership of Administrators using the Members Of This Group setting.
C. Correct: Sydney Support is added to the Administrators group by the Sydney Support GPO. Because the Sydney Support GPO has higher precedence than the Corporate Help Desk GPO, DESKTOP234 applies the Sydney Support GPO after applying the Corporate Help Desk GPO; thus, the Sydney Support GPO’s members are added to the Administrators group.
D. Correct: Help Desk is specified as a member of the Administrators group by the Corporate Help Desk GPO. When this GPO is applied, all other members of
Administrators, except the Administrator account itself, are removed.
E. Incorrect: The Remote Desktop Users group is not a default member

A. Correct: The Scwcmd.exe /transform command creates a GPO that includes the settings in the specified security policy.
B. Incorrect: You do not need to create a GPO. The Scwcmd.exe command does that automatically.
C. Incorrect: You do not import settings from a security policy into a GPO. You can import the settings from a security template into a GPO.
D. Correct: The GPO created must be linked to an appropriate site, domain, or OU before its settings are applied to computers in that container.

A. Incorrect: The Remove-Item cmdlet in Windows PowerShell cannot be used to remove members of a group because groups are not exposed in a namespace.
B. Correct: Dsrm is used to delete a group.
C. Correct: Dsmod with the –remmbr option can remove members from a group.
D. Correct: LDIFDE with a change type of modify and a delete:member operation can remove members from a group.
E. Incorrect: CSVDE can import new groups. It cannot modify existing groups.

A. Correct: CSVDE can import one or more computers from a .csv file, and Excel can save a worksheet as a .csv file.
B. Incorrect: LDIFDE can import one or more computers, but the LDIF format cannot be created using Excel.
C. Incorrect: Dsadd enables you to create computer objects one at a time.
D. Correct: Windows PowerShell enables you to use ADSI to create computers and can use a .csv file as a data source.
E. Correct: VBScript enables you to use ADSI to create computers and can use a .csv file as a data source.

A. Incorrect: You must have one writable domain controller running Windows
Server 2008 before adding an RODC to a domain. You already have a Windows Server 2008 domain controller in the contoso.com domain.
B. Correct: The domain functional level must be at least Windows Server 2003 before adding an RODC.
C. Incorrect: You cannot raise the domain functional level to Windows Server 2008 because you have a domain controller running Windows Server 2003.