Home » Microsoft » 70-640 » Which tools should you use?
Your network contains an Active Directory domain.
The domain contains 5,000 user accounts.
You need to disable all of the user accounts that have a description of Temp.
You must achieve this goal by using the minimum amount of administrative effort.
Which tools should you use?
(Each correct answer presents part of the solution. Choose two.)
A. Find
B. Dsget
C. Dsmod
D. Dsadd
E. Net accounts
F. Dsquery
Correct Answer: CF
Explanation/Reference:
Here we can use Dsquery to find the accounts that have "Temp" as their description and pipe it through to Dsmod to disable them. Should look like this:
dsquery user domainroot -desc "Temp" | dsmod user -disabled yes
Reference 1:
http://technet.microsoft.com/en-us/library/cc725702.aspx
Dsquery user
Finds users in the directory who match the search criteria that you specify. If the predefined search criteria in this command are insufficient, use the more general version of the query command, dsquery *.
Syntax
dsmod user
Parameters
domainroot
Specifies the node in the console tree where the search starts. You can specify the forest root (forestroot), domain root (domainroot), or distinguished name of a node as the start node (<StartNode>). If you specify forestroot, dsquery searches by using the global catalog. The default value is domainroot.
-desc <Description>
Specifies the descriptions of the user objects you want to modify.
Remarks
The results from a dsquery search can be piped as input to one of the other directory service command-line tools, such as Dsget, Dsmod, Dsmove, or Dsrm.
Reference 2:
http://technet.microsoft.com/en-us/library/cc732954.aspx
Dsmod user
Modifies attributes of one or more existing users in the directory.
Syntax
dsmod user
Parameter
-disabled {yes | no}
Specifies whether AD DS disables user accounts for logon. The available values are yes and no. Yes indicates that AD DS disables user accounts for logon and no indicates that AD DS does not disable user accounts for logon.
