Active Directory & Azure AD: OUs, User Accounts, Groups, and Hybrid Identity

What are Organizational Units (OUs)?

OUs are containers in Active Directory that can hold users, groups, computers, and other OUs, allowing for organization and management of resources.

Which of the following are true about organizational units?

OUs can be added to an object's DACL, can be nested, and a GPO can be linked to an OU. Only members of Domain Administrators can work with OUs is false.

How can you view permissions set on an OU?

In Active Directory Users and Computers, click View and then click Advanced Features to access the security settings.

What should you do to allow a junior administrator to reset user accounts in the Operations OU?

In Active Directory Users and Computers, right-click the Operations OU and click Delegate Control to assign the necessary permissions.

What are the categories of user accounts?

User account categories include Local, Global, Domain, and Universal.

Which of the following is a built-in user account?

Built-in user accounts include Administrator and Guest. Operator and Anonymous are not standard built-in accounts.

Which of the following is not a valid user account name?

Sam*Snead35 is not a valid user account name due to the use of an asterisk.

What are the characteristics of user accounts in Windows Server 2016?

User account names can have 1 to 20 characters, are not case sensitive, cannot be duplicated in the domain, and PASSWORD123 is not a valid password with default settings.

Which account options can't be set together?

User must change password at next logon, Store password using reversible encryption, Password never expires, and Account is disabled cannot be set together.

Who can belong to a global group?

Members of a global group can include user accounts and global groups from any domain, but not computer accounts or universal groups.

What should you do with Jada's user account after she leaves?

The best course of action is to disable Jada's account, and when the new employee arrives, rename Jada's account, assign it a new password, and enable it again.

What is the best way to secure Tom's access to sensitive information?

Have screen savers lock computers after 15 minutes of inactivity to prevent unauthorized access.

How can you prevent inappropriate use of computers by employees after hours?

Set the Logon Hours options for their user accounts to restrict access during off-hours.

Which group scope should you use to assign permissions to a resource?

Domain local group scope is typically used to assign permissions to a resource.

What are considered security principals?

Security principals include user accounts, computer accounts, and distribution groups, but not contacts.

What are valid group scopes?

Valid group scopes include Global, Domain local, and Universal. Forest is not a valid group scope.

What happens if a security group that's an ACE in a shared folder is converted to a distribution group?

A security group cannot be converted to a distribution group after permissions are assigned.

What happens to a security group after permissions are assigned?

A security group can't be converted after permissions are assigned.

What occurs when a group is removed from the DACL?

The group is removed from the DACL automatically.

What happens if a group remains in the DACL but the ACE has no effect?

The group remains in the DACL, but the ACE has no effect.

What happens if a group remains in the DACL and permissions continue to function?

The group remains in the DACL and permissions continue to function.

Which accounts can be members of a universal group?

User accounts from the local domain, global groups from any domain in the forest, other universal groups, and domain local groups from the local domain.

Which direct group scope conversion is allowed?

Domain local to universal, global to domain local, domain local to global, and universal to global.

What is true about the Users domain local group?

It's in the Users folder, can be converted to a global group, Domain Users is a member, and its members can log on locally to a domain controller.

Which special identity group does a domain user belong to upon signing in?

Authenticated Users.

What should you try first if a user has trouble signing in to the domain from an inactive computer?

Reset the computer account, remove it from the domain, and rejoin it.

Which service accounts can be managed across multiple servers?

AD managed service account and group managed service account.

What are built-in service accounts?

Anonymous Logon, Local System, Network Service, and Authenticated Users.

What are the advantages of using a managed service account instead of a regular user account?

The system manages passwords, you can assign rights and permissions precisely, you can't be locked out.

What is used to uniquely identify a service instance to a client?

Service Principal Name (SPN).

What should you do after creating an MSA on DC1 for a service on ldsServ1?

Run Install-ADServiceAccount on ldsServ1.

How can you ensure all servers in a load-balancing configuration use the same service account?

Run New-gMSAServiceAccount and specify the four servers.

What should you do to install a service that accesses only local resources with minimal administrative effort?

Configure the service to log on as NT Service\LocSvc.

What collection of services should you deploy for lightweight Azure integration with single sign-on?

Azure AD, Azure AD Connect Cloud Sync, and SSPR.

What process allows users to sign in using one set of credentials without re-entering them?

Single Sign-On (SSO).

What is a characteristic of Azure AD?

Multitenant.

What should you configure if users can no longer sign in to on-premises Active Directory after changing their password in the cloud?

Configure Password Writeback.

Which Azure AD Connect sign-in option requires an on-premises agent?

Pass-through Authentication.

What forest type should you choose to synchronize all objects in Azure AD and all user and group accounts in on-premises Active Directory?

User Forest.

What type of connection should you configure for a secure browser-based connection to a Windows Server VM in Azure?

Bastion Host.