Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains an organizational unit (OU) named OU1 and a user named User1. You plan to deploy a Hyper-V failover…

This question tests knowledge of prestaging Active Directory computer objects for Hyper-V failover clusters and applying least-privilege permissions to allow a specific user to deploy the cluster.

Implement and manage Windows Server high availability

Question

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains an organizational unit (OU) named OU1 and a user named User1. You plan to deploy a Hyper-V failover cluster named Cluster1. You need to prestage the account for Cluster1 and ensure that User1 can deploy Cluster1. The solution must follow the principle of least privilege. Which action should you perform, and which permissions should you grant to User1 for Cluster1?
Possible Actions:
Create a new user account named Cluster1, and then disable the account.
Create a new computer account named Cluster1, and then disable the account.
Create a new computer account named Cluster1.

Possible Permissions:
Allowed to authenticate
Create all child objects
Full control

Explanation

This question tests knowledge of prestaging Active Directory computer objects for Hyper-V failover clusters and applying least-privilege permissions to allow a specific user to deploy the cluster.

Approach. The correct action is to create a new computer account named Cluster1 (not a user account) and then disable it. Failover clusters use a Cluster Name Object (CNO), which must be a computer account in AD DS. It must be pre-created in a disabled state so the cluster deployment wizard can locate and take ownership of it during setup - if it were left enabled, the wizard cannot properly claim it. The correct permission to grant User1 is Full Control over the Cluster1 computer object. While 'Full Control' sounds broad, it is scoped to only that single prestaged computer object, making it the minimum permission needed for User1 to complete the cluster deployment. Granting 'Create all child objects' (an OU-level right) would exceed what is needed, and 'Allowed to authenticate' is insufficient to manage the computer object during cluster creation.

Concept tested. Prestaging Active Directory computer objects (CNO) for Windows Server Failover Clustering, and applying the principle of least privilege by scoping Full Control to a specific AD object rather than broader OU or domain permissions.

Reference. Microsoft Learn - Prestage Cluster Computer Objects in Active Directory Domain Services (https://learn.microsoft.com/en-us/windows-server/failover-clustering/prestage-cluster-adds)

Topics

#Active Directory#Hyper-V Failover Clustering#Cluster Name Object (CNO)#Least Privilege

Community Discussion

No community discussion yet for this question.

Full AZ-801 Practice