nerdexam
CompTIA

SK0-005 · Question #233

An administrator has set up a GPO to disable USB drive access on a company's servers. The GPO is set up as a computer configuration policy and does not use security groups filtering. The administrator

The correct answer is B. Item-level targeting is not configured properly.. If a GPO with computer configuration applies to one OU but not another, and security group filtering is not used, the most likely issue is item-level targeting incorrectly restricting its application.

Security and disaster recovery

Question

An administrator has set up a GPO to disable USB drive access on a company’s servers. The GPO is set up as a computer configuration policy and does not use security groups filtering. The administrator is testing to ensure the policy is working correctly. A server in the accounting OU works as expected, but a server in the sales OU is still allowing access to USB drives. The administrator runs the gpupdate /force command and tries again; however, the server still allows access to the USB drive. Which of the following is the MOST likely cause?

Options

  • AThe WMI filter is not configured properly.
  • BItem-level targeting is not configured properly.
  • CThe scope is not configured properly.
  • DLoopback processing is not configured properly.

How the community answered

(48 responses)
  • A
    17% (8)
  • B
    46% (22)
  • C
    6% (3)
  • D
    31% (15)

Why each option

If a GPO with computer configuration applies to one OU but not another, and security group filtering is not used, the most likely issue is item-level targeting incorrectly restricting its application.

AThe WMI filter is not configured properly.

A WMI filter determines if the entire GPO applies based on WMI queries; if it were misconfigured, it would likely prevent the GPO from applying to any server or to both OUs uniformly, not selectively fail for one OU while succeeding for another without specific targeting.

BItem-level targeting is not configured properly.Correct

Item-level targeting allows specific settings within a Group Policy Preference (GPP) to apply only to users or computers that meet certain criteria, such as being in a particular OU, having a specific IP address range, or OS version. If USB access control was configured via GPP with item-level targeting incorrectly applied to exclude the Sales OU, it would explain why it works for Accounting but not Sales despite the GPO linking.

CThe scope is not configured properly.

The scope of a GPO refers to where it is linked in Active Directory; if the scope was not configured properly, the GPO would either not apply to either OU or would not be linked to the Sales OU, contradicting the premise that the GPO is set up and tested.

DLoopback processing is not configured properly.

Loopback processing is a Group Policy setting that changes how user policies are applied to users logging onto specific computers; since this is a computer configuration policy to disable USB drives, loopback processing is not relevant here.

Concept tested: Group Policy Item-Level Targeting

Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732168(v=ws.10)

Topics

#GPO troubleshooting#Item-level targeting#Group Policy Preferences#Access control

Community Discussion

No community discussion yet for this question.

Full SK0-005 Practice