SK0-005 · Question #233
An administrator has set up a GPO to disable USB drive access on a company's servers. The GPO is set up as a computer configuration policy and does not use security groups filtering. The administrator
The correct answer is B. Item-level targeting is not configured properly.. If a GPO with computer configuration applies to one OU but not another, and security group filtering is not used, the most likely issue is item-level targeting incorrectly restricting its application.
Question
An administrator has set up a GPO to disable USB drive access on a company’s servers. The GPO is set up as a computer configuration policy and does not use security groups filtering. The administrator is testing to ensure the policy is working correctly. A server in the accounting OU works as expected, but a server in the sales OU is still allowing access to USB drives. The administrator runs the gpupdate /force command and tries again; however, the server still allows access to the USB drive. Which of the following is the MOST likely cause?
Options
- AThe WMI filter is not configured properly.
- BItem-level targeting is not configured properly.
- CThe scope is not configured properly.
- DLoopback processing is not configured properly.
How the community answered
(48 responses)- A17% (8)
- B46% (22)
- C6% (3)
- D31% (15)
Why each option
If a GPO with computer configuration applies to one OU but not another, and security group filtering is not used, the most likely issue is item-level targeting incorrectly restricting its application.
A WMI filter determines if the entire GPO applies based on WMI queries; if it were misconfigured, it would likely prevent the GPO from applying to any server or to both OUs uniformly, not selectively fail for one OU while succeeding for another without specific targeting.
Item-level targeting allows specific settings within a Group Policy Preference (GPP) to apply only to users or computers that meet certain criteria, such as being in a particular OU, having a specific IP address range, or OS version. If USB access control was configured via GPP with item-level targeting incorrectly applied to exclude the Sales OU, it would explain why it works for Accounting but not Sales despite the GPO linking.
The scope of a GPO refers to where it is linked in Active Directory; if the scope was not configured properly, the GPO would either not apply to either OU or would not be linked to the Sales OU, contradicting the premise that the GPO is set up and tested.
Loopback processing is a Group Policy setting that changes how user policies are applied to users logging onto specific computers; since this is a computer configuration policy to disable USB drives, loopback processing is not relevant here.
Concept tested: Group Policy Item-Level Targeting
Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732168(v=ws.10)
Topics
Community Discussion
No community discussion yet for this question.