Question
Your network contains an Active Directory Domain Services (AD DS) forest. The forest contains two domains named contoso.com and east.contoso.com. Contoso.com contains two users named CONTOSO\User1 and EAST\User2.
You need to ensure that the users can perform the following tasks:
• User1 must deploy an additional domain controller to east.contoso.com.
• User2 must deploy a new domain controller that will host a domain named west.contoso.com.
The solution must follow the principle of least privilege.
To which group should you add each user? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
User1: EAST\Domain Admins — Adding a domain controller to an existing domain requires membership in the Domain Admins group of that domain. The domain is east.contoso.com, so EAST\Domain Admins is the least-privileged choice. CONTOSO\Domain Admins has no administrative rights in the child domain, CONTOSO\Enterprise Admins would work but grants forest-wide rights, and Schema Admins only controls changes to the schema.
User2: CONTOSO\Enterprise Admins — A domain controller that hosts west.contoso.com is the first domain controller of a new child domain in the forest. Installing a new child domain or a new domain tree requires membership in the Enterprise Admins group, because it adds a domain to the forest's partitions and trusts. Domain Admins of contoso.com or of east.contoso.com does not have the rights to add a new domain to the forest, and Schema Admins only controls changes to the schema.
