You install a read-only domain controller (RODC) named RODC1. You need to ensure that a user named User1 can administer RODC1. The solution must minimize the number of permissions assigned to User1…

Question

Exhibit

Options

• AActive Directory Administrative Center
• BActive Directory Users and Computers
• Cdsadd
• Ddsmgmt

• A
  4% (1)
• B
  75% (21)
• C
  14% (4)
• D
  7% (2)

Explanation

There are a couple of ways to achieve this and two of them are mentioned in the listed answers, Active Directory Users and Computers and Dsmgmt. The article below explains the different ways to implement Administrator Role Separation on an RODC, and why the use of Active Directory Users is recommended over Dsmgmt. Delegating local administration of an RODC Administrator Role Separation (ARS) is an RODC feature that you can use to delegate the ability to administer an RODC to a user or a security group. When you delegate the ability to log on to an RODC to a user or a security group, the user or group is not added the Domain Admins group and therefore does not have additional rights to perform directory service operations. Steps and best practices for setting up ARS You can specify a delegated RODC administrator during an RODC installation or after it. To specify the delegated RODC administrator after installation, you can use either of the following Microsoft 70-648 Exam Modify the Managed By tab of the RODC account properties in the Active Directory Users andComputers snap-in, as shown in the following figure. You can click Change to change which security principal is the delegated RODC administrator. You can choose only one security principal. Specify a security group rather than an individual user so you can control RODC administration permissions most efficiently. This method changes the managedBy attribute of the computer object that corresponds to the RODC to the SID of the security principal that you specify. This is the recommended way to specify the delegated RODC administrator account because the information is stored in AD DS, where it can be centrally managed by domain administrators. . Use the ntdsutil local rolescommand or the dsmgmt local rolescommand. You can use this command to view, add, or remove members from the Administrators group and other built-in groups on the RODC. Using ntdsutil or dsmgmt to specify the delegated RODC administrator account is not recommended because the information is stored only locally on the RODC. (...)using the Active Directory Users and Computers snap-in or a similar tool will not reveal that the RODC has a delegated administrator.

No community discussion yet for this question.