Your network consists of two Active Directory forests named Forest1 and Forest2. The functional level of both forests is Windows Server 2003. Both forests contain only domain controllers that run…

Question

Options

• ARaise the forest functional level of Forest1 and Forest2 to Windows Server 2008.
• BRaise the domain functional level of all domains in both forests to Windows Server 2008.
• CCreate a forest trust between Forest1 and Forest2.
• DCreate a forest trust between Forest1 and Forest2.

• A
  17% (3)
• B
  6% (1)
• C
  72% (13)
• D
  6% (1)

Explanation

To ensure that the users in Forest1 are denied access to all the resources Forest2 except the resources on Server1, you need to create a forest trust between Forest1 and Forest2 so that resources can be shared between both the forests. You can however set the trust authentication setting to selective authentication so that only selected authentication is allowed. Next you need to set the Allowed to Authenticate right on the computer object for Server1 so that each user must be explicitly granted the Allowed to Authenticate permission to access resources You should not set the Allowed to Authenticate right on the computer object for the Forest2 infrastructure operations master object because Allowed to Authenticate right is set for the users in a trusted Windows Server 2003 domain or forest to be able to access resources in a trusting Windows Server 2003 domain or forest, where the trust authentication setting has been set to selective authentication, each user must be explicitly granted the `Allowed to Authenticate' permission on the security descriptor of the computer objects (resource computers) that reside in the trusting domain or forest. 39e4b3cc7da81033.mspx?mfr=true

No community discussion yet for this question.