98-365 · Question #125
You manage a company's Active Directory. You need to delegate the control of a branch office to a set of administrators. Where would you place the users and computers that belong to the branch office?
The correct answer is B. In an Organizational Unit. To effectively delegate administrative control within Active Directory, users and computers for a specific branch office should be organized into an Organizational Unit (OU).
Question
You manage a company's Active Directory. You need to delegate the control of a branch office to a set of administrators. Where would you place the users and computers that belong to the branch office?
Options
- AIn a distribution group
- BIn an Organizational Unit
- CIn the root of the domain
- DIn the Built-in container
How the community answered
(36 responses)- A14% (5)
- B78% (28)
- C6% (2)
- D3% (1)
Why each option
To effectively delegate administrative control within Active Directory, users and computers for a specific branch office should be organized into an Organizational Unit (OU).
A distribution group is used for email distribution lists and cannot be used to organize objects for administrative delegation or Group Policy application.
Organizational Units (OUs) are containers in Active Directory specifically designed for organizing users, groups, computers, and other OUs. They are crucial for delegating administrative control over specific sets of objects and for applying Group Policy Objects (GPOs) to distinct subsets of the domain. Placing branch office objects in an OU allows for granular delegation of control to branch administrators without granting them rights over the entire domain.
Placing objects in the root of the domain makes it difficult to delegate specific control and apply granular Group Policies, as policies applied at the root affect the entire domain.
The Built-in container holds default Active Directory objects and is generally not recommended for creating new objects or for delegation purposes due to security implications and lack of GPO linking capabilities.
Concept tested: Active Directory Organizational Units and Delegation
Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/organizational-units
Topics
Community Discussion
No community discussion yet for this question.