A user's computer fails. The help desk provides the user with a new computer. The user's Documents folder is restored from the backup. The user reports that he can no longer access his encrypted…

Question

Options

• Acredential roaming be enabled
• BBitLocker be enabled on all computers
• Cuser accounts be trusted for delegation
• Dthe CA be configured for key archival and recovery

• A
  86% (24)
• B
  7% (2)
• C
  4% (1)
• D
  4% (1)

Explanation

Credential roaming allows organizations to store certificates and private keys in Active Directory Domain Services (AD DS) separately from application state or configuration information. Credential roaming uses existing logon and autoenrollment mechanisms to securely download certificates and keys to a local computer whenever a user logs on and, if desired, remove them when the user logs off. In addition, the integrity of these credentials is maintained under any conditions, such as when certificates are updated and when users log on to more than one computer at a time. This security setting determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set.

No community discussion yet for this question.