Question
Your network contains an Active Directory forest. The forest contains two domains named contoso.com and east.contoso.com and the servers shown in the following table.
| Name | Domain | Configuration |
|---|---|---|
| DC1 | contoso.com | Domain controller |
| Server1 | contoso.com | Member server |
| DC2 | east.contoso.com | Domain controller |
| Server2 | east.contoso.com | Member server |
Contoso.com contains a user named User1.
You add User1 to the built-in Backup Operators group in contoso.com.
Which servers can User1 back up?
- A. DC1 only Correct
- B. Server1 only
- C. DC1 and DC2 only
- D. DC1 and Server1 only
- E. DC1, DC2, Server1, and Server2
Explanation
The Backup Operators group in Active Directory is a built-in (Builtin container) domain local group. Its membership is stored in the domain database, so it takes effect only on the domain controllers of that domain. Microsoft documents that this group can perform backup and restore operations on domain controllers. Member servers such as Server1 do not use the domain's Builtin groups. Each member server has its own local Backup Operators group in its SAM database, and User1 has not been added to that group. The group also has no effect in another domain, so DC2 and Server2 in east.contoso.com are excluded. User1 can therefore back up DC1 only.
