Help I am troubled with Transcenders.

jefftruitt

O wise and mighty gurus I need help with group policy. I have the Transcenders 70-215 practice tests. There is a question pertaining to group policy that baffles me. Here goes:

You want to deploy an application for the users in The Human Resources dept. All those users belong to the HR Global Group. You create a Windows Installer Package and you want to assign the package to the members of the HR group.

Which of the following is the easiest way to make the application available to the HR members?

a. Create a Group Policy Object (GPO) linked to the domain to which the HR group belongs, specify the package in the GPO and assign the the appropriate security permissions for the GPO to the HR group.[/b]
b. Place the HR group into the same OU, create a GPO linked to the OU and specify the package in the GPO.

c. Create a GPO linked to the HR group and specify the package in the GPO.

d. Creat a GPO linked to the domain to which the HR group belongs, specify the package in the GPO and delegate control of the GPO to the HR group.

Transcenders says that answer a is correct. Is the assign verbage a dead giveaway? Can anyone explain this to me? or refer me to some good online documentation.

Maxxxie

Howdy Jeff,

The answer is indeed a.

The key here is that there is no OU named HR, just a global group. Therefore the way to make sure members of this group receive the package (assigned or published, doesn't make a difference in this scenario) is to assign a GPO to the Domain, then set permissions on the GPO such that they apply to the HR Group.

The obvious question is, I guess, why not just make an OU for the HR people and assign the GPO to the OU?

Members of the HR Group might already belong to other OUs and for administrative reasons the administrator might not wish to put them in a separate OU.

As to why it is not one of the other answers:

b. Place the HR group into the same OU, create a GPO linked to the OU and specify the package in the GPO.

Putting a group into an OU doesn't do much in terms of applying the GPO to members of that group. To do this using the OU method, the individual user accounts would all have to be placed into the new OU. In the case of an organisation that has hundreds of users in the HR department, this might be a royal pain the arse. See my comments above too.


c. Create a GPO linked to the HR group and specify the package in the GPO.

You can't link a GPO to a group. GPOs can be linked to sites, domains and OUs. Policy precedence is applied as follows: local policy, site policy, domain policy, OU policy.


d. Create a GPO linked to the domain to which the HR group belongs, specify the package in the GPO and delegate control of the GPO to the HR group.

Linking the GPO to the domain, without restricting it via permissions, would apply it to all users/computers in the domain. In this scenario, no permissions have been assigned. All this answer has done is to delegate control of the GPO to the HR Group. This means that anyone in the HR Group could manipulate/change the GPO. It does not mean that the GPO settings affect members of the group.

The Transcenders refer to the Windows 2000 Server Resource Kit. This is a tremendously useful resource for study purposes. There's a LOT of information there, you gotta take the time to read it... but it is useful.

From the res kit:

"Filtering by Security Group Membership
You can filter the effects of Group Policy on computers and users by using membership in security groups and setting discretionary access control list (DACL) permissions. This implementation ensures faster processing of Group Policy objects than would otherwise be possible. Furthermore, by using security groups, you can limit who in your organization can create Active Directory links to Group Policy objects, as well as who has access to create and modify Group Policy objects."

Also:
"Filtering the Scope of a Group Policy Object
You can refine which groups of computers and users a particular Group Policy object influences by using Windows 2000 security groups. To do this, use the Security tab on the Properties page of the Group Policy object.

Filtering affects the Group Policy object as a whole. That is, you cannot use security groups to apply (or prevent from applying) only some of the settings in a Group Policy object. However, this is not true in the cases of Folder Redirection and Software Installation, which have further ACLs set at the Group Policy object level to further refine behavior based on security group membership."

There's heaps more, but I'm not gonna post it (copyright and all).. you can get a lot of the resource kit documentation online from Microsoft's site.


Hope this helps!!
Max

jefftruitt wrote:

O wise and mighty gurus I need help with group policy. I have the Transcenders 70-215 practice tests. There is a question pertaining to group policy that baffles me. Here goes:

You want to deploy an application for the users in The Human Resources dept. All those users belong to the HR Global Group. You create a Windows Installer Package and you want to assign the package to the members of the HR group.

Which of the following is the easiest way to make the application available to the HR members?

a. Create a Group Policy Object (GPO) linked to the domain to which the HR group belongs, specify the package in the GPO and assign the the appropriate security permissions for the GPO to the HR group.[/b]

b. Place the HR group into the same OU, create a GPO linked to the OU and specify the package in the GPO.

c. Create a GPO linked to the HR group and specify the package in the GPO.

d. Creat a GPO linked to the domain to which the HR group belongs, specify the package in the GPO and delegate control of the GPO to the HR group.

Transcenders says that answer a is correct. Is the assign verbage a dead giveaway? Can anyone explain this to me? or refer me to some good online documentation.

jefftruitt

Hey Max,

Thanks for the in-depth input, I really appreciate it. I figured out the whole GPO and AD stuff for the most part. I just passed the test (70-215), now its on 70-218 (I will be an MCSA after I pass this one). Do you have any suggestions for the 70-218 or any study references? What does the test cover as an overview, I mean besides the obvious (Managing a Windows 2000 Network environment). Any help would be appreciated.

Thanks in advance,

Jeff

Maxxxie

Hiya Jeff

I just did the 215 exam today. A lot easier than I thought it would be, though there were a few more IIS questions than I'd planned on (not that it really matters, I guess).

Right now, my focus is on 216. I am using the MCSE subjects as credit for a university program, and 216 is next in their list of pre-requisites.

I will ultimately be doing 218 to get the MCSA, probably after I complete the 216 exam.

As for training resources, of course I like the Transcenders as they give a good explanation of topics and use good references for further reading. I used them for my NT4.0 MCSE and the win2k subjects I've done so far.

MS have released new editions of their study guides and have released a study guide for the 218 exam. Truthfully, I wasn't too impressed with the MS books for 210 or 215, so I'm not especially interested in purchasing their 218 guide. I found Sybex were useful, Exam Cram too. Honestly, the resource kits are great - but you gotta know where to look for the information! It can be a bit of information overload.

The consensus appears to be that the 218 exam is a mix of 210, 215, 216 and 217. Perhaps if you focus on study for the individual exams, you'll know all you need to know for 218 and more.

Glad to hear you passed 215, buddy. Nail 218 to the ground!!

Max

jefftruitt

Hello Max,

Thanks for the info, I have been using Exam Cram books, they really don't go into detail about a particular subject, but they have sufficed. I thought the 70-215 was alot easier than I anticipated, I think I may have missed 2 or 3 questions (Microsoft doesn't score tests anymore, it's either Pass or Fail). I have been looking around for 70-218 pratice tests and they are not as plentiful as other Core tests. Do you have any ideas or links you can refer me too.

See ya,

Jeff