Administering Windows Server 2012 Group Policy Management & Configuration 3 — Questions and Answers
Question 1: Which built-in GPO is linked at the domain level and contains the default password and account lockout policies in Windows Server 2012?
- Default Domain Controllers Policy
- Default Domain Policy (Correct answer)
- Domain Security Baseline GPO
- Default Security Policy
Correct answer: Default Domain Policy
The Default Domain Policy is linked at the domain root and defines the default password policy, account lockout policy, and Kerberos policy for all domain users.
Question 2: An administrator uses Group Policy Preferences to map a network drive. Unlike Group Policy settings, what happens when the GPO no longer applies to the user?
- The drive mapping is immediately removed
- The drive mapping remains until manually removed (Correct answer)
- The system reverts to the previous drive mapping
- The user receives a warning and the mapping is removed after 24 hours
Correct answer: The drive mapping remains until manually removed
Group Policy Preferences are not enforced like true policy settings; when the GPO no longer applies, preference items persist until an administrator configures them to be removed.
Question 3: Which Group Policy extension allows administrators to configure Internet Explorer settings such as homepage and security zones for all domain users?
- Administrative Templates
- Internet Explorer Maintenance (IEM)
- Group Policy Preferences (Internet Settings) (Correct answer)
- Software Restriction Policies
Correct answer: Group Policy Preferences (Internet Settings)
In Windows Server 2012, Internet Explorer Maintenance was removed; Internet Explorer settings are now managed through Group Policy Preferences (Internet Settings) under User Configuration.
Question 4: What is the function of the 'Enforce' option when right-clicking a GPO link in the Group Policy Management Console?
- It forces an immediate gpupdate on all computers in the linked OU
- It prevents child OUs from blocking the GPO's inheritance (Correct answer)
- It locks the GPO from being edited by other administrators
- It increases the GPO's processing priority above other linked GPOs
Correct answer: It prevents child OUs from blocking the GPO's inheritance
The Enforced setting on a GPO link prevents child containers from using Block Inheritance to override the GPO's settings, ensuring the policy is always applied.
Question 5: Which command-line tool can be used to back up and restore Group Policy Objects in Windows Server 2012?
- gpresult
- gpedit
- gpmc /backup
- Backup-GPO (PowerShell) (Correct answer)
Correct answer: Backup-GPO (PowerShell)
The PowerShell cmdlet Backup-GPO (part of the GroupPolicy module) is used to back up GPOs, while Restore-GPO is used to restore them.
Question 6: A user complains that a Group Policy setting is not being applied to their account. After checking GPO links and scope, which tool should be used to see exactly which GPOs are being applied and which are being filtered?
- Event Viewer Application Log
- gpresult /R or gpresult /H (Correct answer)
- Active Directory Users and Computers
- Performance Monitor
Correct answer: gpresult /R or gpresult /H
The gpresult command with /R (summary) or /H (HTML report) displays the Resultant Set of Policy, showing applied GPOs, filtered GPOs, and the reasons for filtering.
Question 7: When multiple GPOs are linked to the same OU, which one takes highest precedence by default?
- The GPO with the oldest creation date
- The GPO listed highest in the link order (lowest link order number) (Correct answer)
- The GPO listed lowest in the link order (highest link order number)
- The GPO with the most settings configured
Correct answer: The GPO listed highest in the link order (lowest link order number)
When multiple GPOs are linked to the same container, the GPO with the lowest link order number (listed at the top of the list in GPMC) is processed last and therefore takes highest precedence.
Administering Windows Server 2012 Group Policy Management & Configuration 3
Which built-in GPO is linked at the domain level and contains the default password and account lockout policies in Windows Server 2012?