Chapter 3: User and Service Account Configuration

Question 1

Group Policy Object (GPO)

Answer 1

A GPO is a list of settings administrators use to configure user and computer operating environments remotely

Question 2

GPO scope

Answer 2

GPO scope defines which objects a GPO affects

Question 3

Default GPOs (2)

Answer 3

There are two GPOs that are created when AD is installed and linked to two containers:

Default Domain policy, Default Domain Controllers Policy

Question 4

Default Domain policy

Answer 4

The default domain policy is linked to the domain object and defines the settings for all users and computers in the domain

Question 5

Default Domain Controller policy

Answer 5

The default domain controllers policy is linked to the Domain Controllers OU and specifies default policy settings for all domain controllers in the domain

Question 6

Group Policy Management Console (GPMC)

Answer 6

The group policy management console can be used to view, create, and management GPOs

Question 7

GPO nodes in GMPC

Answer 7

Each GPO has two main nodes in the GPMC:

Computer configuration - used to set policies that apply to computer’s within the GPOs scope

User Configuration - used to set policies that apply to all users in the GPOs scope

Question 8

Account policies

Answer 8

Account policies control settings related to user authentication and logon

Question 9

Kerberos

Answer 9

Kerberos is the authentication protocol used in a Windows domain environment to authenticate logons and grant accounts access to domain resources

Question 10

An account policy linked in an OU that contains computer accounts affects what?

Answer 10

Account policies set in GPOs that are linked to an OU containing computer accounts will only affect local user accounts defined in the computer’s SAM database

Question 11

A service account

Answer 11

A service account is a user account that Windows services use to log on with a specific set of rights and permissions

Question 12

Managed Service Account (MSA)

Answer 12

A managed service accounts enables administrators to manage rights and permissions for services with automatic password management

Question 13

Service principal name (SPN)

Answer 13

A service principal name is a name that uniquely identifies a service instance to a client

Question 14

What does kerberos delegation do?

Answer 14

Kerberos delegation allows a service to impersonate a client, relieving them of having to authenticate to more than one service.