Home » Microsoft » 70-647 » What should you recommend?
Your network consists of two Active Directory forests named Forest1 and Forest2. The functional level of both forests is Windows Server 2003. Both forests contain only domain controllers that run Windows Server 2008.
You install a new server named Server1 in Forest2.
You need to recommend an access solution that meets the following requirements:
- Users in Forest1 must have access to resources on Server1.
- Users in Forest1 must be denied access to all other resources within Forest2.
What should you recommend?
A. Raise the forest functional level of Forest1 and Forest2 to Windows Server 2008.
B. Raise the domain functional level of all domains in both forests to Windows Server 2008.
C. Create a forest trust between Forest1 and Forest2. Set the Allowed to Authenticate right on the computer object for Server1.
D. Create a forest trust between Forest1 and Forest2. Set the Allowed to Authenticate right on the computer object for the Forest2 infrastructure operations master object.
Correct Answer: C
Explanation/Reference:
Explanation:
To ensure that the users in Forest1 are denied access to all the resources Forest2 except the resources on Server1, you need to create a forest trust between Forest1 and Forest2 so that resources can be shared between both the forests. You can however set the trust authentication setting to selective authentication so that only selected authentication is allowed.
Next you need to set the Allowed to Authenticate right on the computer object for Server1 so that each user must be explicitly granted the Allowed to Authenticate permission to access resources on Server1.
You should not set the Allowed to Authenticate right on the computer object for the Forest2 infrastructure operations master object because Allowed to Authenticate right is set for the users in a trusted Windows Server 2003 domain or forest to be able to access resources in a trusting Windows Server 2003 domain or forest, where the trust authentication setting has been set to `Allowed to Authenticate’ selective authentication, each user must be explicitly granted the permission on the security descriptor of the computer objects (resource computers) that reside in the trusting domain or forest.
Reference: Grant the Allowed to Authenticate permission on computers in the trusting domain or forest
http://technet2.microsoft.com/windowsserver/en/library/b4d96434-0fde-4370-bd29- 39e4b3cc7da81033.mspx?mfr=true
