Home » Microsoft » 70-640 » What should you do to perform this task?
You are an administrator at vceguide.com.
The company has a network of 5 member servers acting as file servers. It has an Active Directory domain.
You have installed a software application on the servers.
As soon as the application is installed, one of the member servers shuts down. To trace and rectify the problem, you create a Group Policy Object (GPO).
You need to change the domain security settings to trace the shutdowns and identify the cause of it.
What should you do to perform this task?
A. Link the GPO to the domain and enable System Events option
B. Link the GPO to the domain and enable Audit Object Access option
C. Link the GPO to the Domain Controllers and enable Audit Object Access option
D. Link the GPO to the Domain Controllers and enable Audit Process tracking option
E. Perform all of the above actions
Correct Answer: A
Explanation/Reference:
http://msdn.microsoft.com/en-us/library/ms813610.aspx
Audit system events
Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesAudit Policy
Description
Determines whether to audit when a user restarts or shuts down the computer; or an event has occurred that affects either the system security or the security log.
By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and in the local policies of workstations and servers.
If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when a system event is successfully executed.
Failure audits generate an audit entry when a system event is unsuccessfully attempted. You can select No auditing by defining the policy setting and unchecking Success and Failure.
