290 Group Question - Confused

[shiyam198]

Hi Guys,

Hope you can help me with this. I have worked in AD for a year and half. And studied for 290 now and taking the exam day after. Did a lot of labs. But this question has put me in to confused state:

You are an Admin for CK.com. This forrest has US.ck.com and UK.ck.com domains.
The functional level of both US.ck.com and UK.ck.com is Windows 2000 mixed.

us.ck.com has give DCs; 3 of these run windows 2000 server and 2 run windows 2003 server. Shared folders are hosted in US.CK.COM domain. Users in UK.CK.COm needs access to these shared folders. You decide to create a group named UK_users in US.CK.COM domain. UK users who needs accesss to the mentioned shared folders in US.CK.COM domain, will be added to thise group - UK_Users. You will then required access permissions to UK_users Group.

How should you configure UK_users Group?

THE ANSWER MENTIONED HERE IS : DOMAIN LOCAL GROUP.

I KNOW DLGs CAN HAVE USERS FROM OTHER DOMAINS AS MEMBERS. BUT NORMALLY DLGs ARE USED TO ASSIGN TO A RESOURCE. AND THEN GLOBAL GROUP (WHICH HAS THE MEMBERS - USERS) BECOMES THE MEMBER OF THIS DLG. THATS HOW I HAVE BEEN TAUGHT.

WAS THE ABOVE ANSWERS MENTIONED FOR THE QUESTION IS CORRECT ? OR MY PRACTICE IS CORRECT ?

PLEASE LET ME KNOW,

Shiyam

 

[pagy]

Someone will correct if I'm wrong but I don't think you can have domain local groups at a 2000 mixed domain level. I'm pretty sure you can only use domain local groups when you move to 2000 native mode.

That question really does not look right to me, where did you come across this question??

Paul
MCSE


"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein

 

[mrdenny]

This is the problem with the Brain Dump sites. There is no guarantee that the questions and answers are correct and accurate.

If memory serves domain global groups can not have members from other domains, and Enterprise Groups aren't available in the listed mode.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

My Blog

 

[pagy]

mrdenny is correct about global groups, they can only have members from their own domin

And I assume he means universal groups

Paul
MCSE


"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein

 

[shiyam198]

This is from a brain Dump. Actualtests.com. My exam is tomorrow. I have done my labs and studied. I wanted to do these questions so I can familiarize my self. It looks like they might make me forget what I have learnt already. Now, when I get a question I answer wrong, i don't know if i was wrong or this question is wrong. I actually thought these were past questions from MCSE - 290.

 

[pagy]

I think the question is a pile if rubbish personally. I'm not familiar with actualtests.com but brain dumps are never good. As mrdenny said there is no guranntee that either the question or answer is correct.

If you want to familiarise yourself with the type of questions I reccommend measureup.com

Paul
MCSE


"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein

 

[mrdenny]

Microsoft also frowns on the brain dump sites for a couple of reasons.

1. The issue I brought up above.
2. Microsoft considers them cheating. The point of the exams is to test your knowledge of the product, not your ability to memorize questions and answers.

And since Microsoft does consider them cheating, and all cheating on MCP exams is rewarded with a loss of all certifications... you do the math.

In my opinion (especially with as many certs as I've got) it's just not worth the risk.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

My Blog

 

[NickFerrar]

I can't see a problem with the question/answer myself?

DLG is the correct group choice and the 'MS best practice' group to use for assigning permissions to. DLG is supported in mixed mode (we use them and are in mixed mode).

In terms of what you put into DLGs then if the users are in the same domain then 'MS best practice' is to stick them in a global group first. If users are from another domain then just stick them directly into the DLG or stick them into a global group in their local domain and add that global group into the DLG in the other domain. I personally wouldn't use universal groups in this scenario as the requirement is one way resource access to one domain.

 

[pagy]

This;

Domain local groups are only available in native mode domains and can contain members from anywhere in the forest, in trusted forests, or in a trusted pre–Windows 2000 domain. Domain local groups can only grant permissions to resources within the domain in which they exist. Typically, domain local groups are used to gather security principals from across the forest to control access to resources within the domain.

From here;

http://www.microsoft.com/technet/pr...erv/reskit/deploy/dgbf_upg_jcik.mspx?mfr=true

Paul
MCSE


"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein