Help I am troubled with Transcenders.

jefftruitt

O wise and mighty gurus I need help with group policy. I have the Transcenders 70-215 practice tests. There is a question pertaining to group policy that baffles me. Here goes:

You want to deploy an application for the users in The Human Resources dept. All those users belong to the HR Global Group. You create a Windows Installer Package and you want to assign the package to the members of the HR group.

Which of the following is the easiest way to make the application available to the HR members?

a. Create a Group Policy Object (GPO) linked to the domain to which the HR group belongs, specify the package in the GPO and assign the the appropriate security permissions for the GPO to the HR group.[/b]
b. Place the HR group into the same OU, create a GPO linked to the OU and specify the package in the GPO.

c. Create a GPO linked to the HR group and specify the package in the GPO.

d. Creat a GPO linked to the domain to which the HR group belongs, specify the package in the GPO and delegate control of the GPO to the HR group.

Transcenders says that answer a is correct. Is the assign verbage a dead giveaway? Can anyone explain this to me? or refer me to some good online documentation.

Maxxxie

Howdy Jeff,

The answer is indeed a.

The key here is that there is no OU named HR, just a global group. Therefore the way to make sure members of this group receive the package (assigned or published, doesn't make a difference in this scenario) is to assign a GPO to the Domain, then set permissions on the GPO such that they apply to the HR Group.

The obvious question is, I guess, why not just make an OU for the HR people and assign the GPO to the OU?

Members of the HR Group might already belong to other OUs and for administrative reasons the administrator might not wish to put them in a separate OU.

As to why it is not one of the other answers:

b. Place the HR group into the same OU, create a GPO linked to the OU and specify the package in the GPO.

Putting a group into an OU doesn't do much in terms of applying the GPO to members of that group. To do this using the OU method, the individual user accounts would all have to be placed into the new OU. In the case of an organisation that has hundreds of users in the HR department, this might be a royal pain the arse. See my comments above too.


c. Create a GPO linked to the HR group and specify the package in the GPO.

You can't link a GPO to a group. GPOs can be linked to sites, domains and OUs. Policy precedence is applied as follows: local policy, site policy, domain policy, OU policy.


d. Create a GPO linked to the domain to which the HR group belongs, specify the package in the GPO and delegate control of the GPO to the HR group.

Linking the GPO to the domain, without restricting it via permissions, would apply it to all users/computers in the domain. In this scenario, no permissions have been assigned. All this answer has done is to delegate control of the GPO to the HR Group. This means that anyone in the HR Group could manipulate/change the GPO. It does not mean that the GPO settings affect members of the group.

The Transcenders refer to the Windows 2000 Server Resource Kit. This is a tremendously useful resource for study purposes. There's a LOT of information there, you gotta take the time to read it... but it is useful.

From the res kit:

"Filtering by Security Group Membership
You can filter the effects of Group Policy on computers and users by using membership in security groups and setting discretionary access control list (DACL) permissions. This implementation ensures faster processing of Group Policy objects than would otherwise be possible. Furthermore, by using security groups, you can limit who in your organization can create Active Directory links to Group Policy objects, as well as who has access to create and modify Group Policy objects."

Also:
"Filtering the Scope of a Group Policy Object
You can refine which groups of computers and users a particular Group Policy object influences by using Windows 2000 security groups. To do this, use the Security tab on the Properties page of the Group Policy object.

Filtering affects the Group Policy object as a whole. That is, you cannot use security groups to apply (or prevent from applying) only some of the settings in a Group Policy object. However, this is not true in the cases of Folder Redirection and Software Installation, which have further ACLs set at the Group Policy object level to further refine behavior based on security group membership."

There's heaps more, but I'm not gonna post it (copyright and all).. you can get a lot of the resource kit documentation online from Microsoft's site.


Hope this helps!!
Max

jefftruitt wrote:

O wise and mighty gurus I need help with group policy. I have the Transcenders 70-215 practice tests. There is a question pertaining to group policy that baffles me. Here goes:

You want to deploy an application for the users in The Human Resources dept. All those users belong to the HR Global Group. You create a Windows Installer Package and you want to assign the package to the members of the HR group.

Which of the following is the easiest way to make the application available to the HR members?

a. Create a Group Policy Object (GPO) linked to the domain to which the HR group belongs, specify the package in the GPO and assign the the appropriate security permissions for the GPO to the HR group.[/b]

b. Place the HR group into the same OU, create a GPO linked to the OU and specify the package in the GPO.

c. Create a GPO linked to the HR group and specify the package in the GPO.

d. Creat a GPO linked to the domain to which the HR group belongs, specify the package in the GPO and delegate control of the GPO to the HR group.

Transcenders says that answer a is correct. Is the assign verbage a dead giveaway? Can anyone explain this to me? or refer me to some good online documentation.