Question
Your network contains an Active Directory Domains Services (AD DS) forest named adatum.com. Adatum.com contains the users shown in the following table.
| Name | In domain | Member of |
|---|---|---|
| User1 | adatum.com | ADATUM\Enterprise Admins, Domain Users |
| User2 | east.adatum.com | EAST\Domain Admins, Domain Users |
| User3 | east.adatum.com | Domain Users |
You deploy a workgroup server named RODC1 that runs Windows Server. RODC1 contains a user named User4 that is a member of the local Administrators group.
You pre-create a read-only domain controller (RODC) account named RODC1 in east.adatum.com and delegate RODC installation and administration permissions to User3.
You sign-in to RODC1 as User4.
Which credentials can be used to promote RODC1 to a RODC in east.adatum.com?
- A. User3 only
- B. User3 and User1 only
- C. User3 and User2 only
- D. User1, User2, and User3 Correct
Explanation
User3 can promote RODC1 due to delegated permissions. User2 can do so as a member of EAST\Domain Admins, and User1 can because they are an Enterprise Admin with forest-wide rights.
