You network consists of one Active Directory domain. All domain controllers run either Windows Server 2008 R2 or Windows Server 2003 SP2. A custom application stores passwords in Active Directory…

Question

Options

• AUpgrade the schema master to Windows Server 2008 R2.
• BUpgrade the infrastructure master to Windows Server 2003 Service Pack 2 (SP2).
• CUpgrade all domain controllers to Windows Server 2008 R2.
• DUpgrade all domain controllers to Windows Server 2008 R2.

• A
  2% (1)
• B
  9% (4)
• C
  82% (37)
• D
  7% (3)

Explanation

To deploy read-only domain controllers (RODCs) on the network, you need to upgrade all domain controllers to Windows Server 2008. To make sure that the custom application passwords are not replicated to the RODCs, you need to add the custom application password attribute to the RODC filtered attribute set and mark the attribute as confidential. The RODC filtered attribute set is a dynamic set of attributes that is not replicated to any RODCs in the forest. You can configure the RODC filtered attribute set on a schema master that runs Windows Server 2008. When the attributes are prevented from replicating to RODCs, that data cannot be exposed unnecessarily if an RODC is stolen or compromised. In addition, it is recommended that you also mark as confidential any attributes that you configure as part of the RODC filtered attribute set. Marking the attribute as confidential provides an additional safeguard against an RODC that is compromised by removing the permissions that are necessary to read the credential-like data. 302a47101e611033.mspx?mfr=true

No community discussion yet for this question.