Question
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the users shown in following table.
| Name | Member of |
|---|---|
| User1 | Enterprise Admins group |
| User2 | Domain Users group |
You have a workgroup server named Server1 that runs Windows Server and contains the local users shown in the following table.
| Name | Member of |
|---|---|
| User3 | Administrators group |
| User4 | Users group |
You promote Server1 to the first domain controller in a new child domain named east.contoso.com.
Which users can sign in to Server1 locally?
- A. User1 only
- B. User3 only
- C. User1 and User2 only
- D. User1 and User3 only Correct
- E. User3 and User4 only
- F. User1, User2, User3 and User4
Explanation
When a workgroup server is promoted to the first domain controller in a new domain, its local accounts are converted to domain accounts in that domain and added to the matching built-in domain groups. User3 becomes a member of the built-in Administrators group of east.contoso.com, and User4 becomes a member of the built-in Users group. On a domain controller, the Allow log on locally right is granted by default only to administrative and operator groups such as Administrators, Account Operators, Backup Operators, Print Operators and Server Operators, not to Users or Domain Users. The Enterprise Admins group is automatically added to the Administrators group in every domain in the forest, so User1 can sign in locally. User2 (Domain Users) and User4 (Users) cannot. Therefore only User1 and User3 can sign in to Server1 locally.
