Question
You have a Group Policy Object (GPO) named GPO1 that contains user settings only.
You plan to apply GPO1 to a global security group named Group1.
You link GPO1 to the domain, and you remove all the permissions granted to the Authenticated Users group.
You need to configure permissions for GPO1 to meet the following requirements:
✑ GPO1 must apply only to the users in Group1.
✑ The solution must use the principle of least privilege.
Which permissions should you grant to Group1 and the Domain Computers group? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation
Group1: Apply group policy and Read. GPO1 contains only user settings and must apply only to the users in Group1. Security filtering requires the target users to have both Read and Apply group policy on the GPO; with Read only, the users could read GPO1 but would never process it.
Domain Computers: Read only. Since security update MS16-072, the Group Policy client retrieves user policy in the computer's security context. Because Authenticated Users was removed from GPO1, the computers that Group1 users sign in to need Read on GPO1, or the GPO is never downloaded. Microsoft's guidance is to grant Domain Computers Read and not Apply group policy, which also meets the least-privilege requirement.
