Re: Possible Bad Question

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Stew Basterash (stewartbash_at_hotmail.com)
Date: 04/02/04 

Date: Fri, 2 Apr 2004 13:14:56 -0600

Once a computer is added to a domain policies are applied in this order LSDO
(Local, Site, Domain, OU)... Since the local policy dictates 3 logon
attempts, and the Domain policy dictates 5 then "5" is the result becuase
the setting is overridden in the order of application... In addition, it
doesn't matter if she logs in locally or to an actual domain account...
System ("computer") Policy settings are applied at startup regardless if she
actually logs into her domain account or not... As I stated... Computer
settings in a policy are applied at startup... User settings are applied at
account login...

"TechGeekPro" <%username%@yahoo.com> wrote in message
news:%23f9pCOOGEHA.1012@TK2MSFTNGP11.phx.gbl...
> I'm taking a practice test for the 70-218 using the CramMaster software.
>
> Question:
>
> Jennifer is an employee of a company called XYZ Dimensions Inc. located in
> Chicago. Jennifer is currently using a stand-alone Windows 2000
Professional
> workstation, named JennyW2KP, to use a locally installed graphics editing
> application. As the administrator, you are going to add JennyW2KP to the
> Windows 2000 Domain, named XYZDimensions.edu, which currently consists of
> one Windows 2000 Server Domain Controller and four Windows 2000
Professional
> workstations.
>
> Before adding JennyW2KP to the XYZDimensions.edu Domain, you use the Local
> Group Policy MMC snap-in on JennyW2KP and configure the account lockout
> policy to lock out Jennifer's local user account after three bad logon
> attempts. Afterwards, you configure the Default Domain Controllers Policy
to
> lockout Jennifer's Domain Account after two bad logon attempts.
>
> What will be Jennifer's result if she attempts to logon to the Windows
2000
> Network using her Domain Logon account and providing an invalid password
> both times? Select the correct answer.
>
> A Jennifer will be locked out of the Windows 2000 Network for a
> configured amount of time designated by the administrator.
>
> B Jennifer will be allowed three more logon attempts to the Windows
> 2000 Network because the Local Group Policy and Default Domain Controllers
> Policy cumulatively allow her five bad logon attempts.
>
> C Jennifer will be allowed one more logon attempt to the Windows
2000
> Professional machine because the Local Group Policy allows her three bad
> logon attempts.
>
> D Jennifer will be allowed one more logon to the Windows 2000
Network
> because the Local Group Policy overrides the Group Policy.
>
>
> Correct answer:
>
> B Jennifer will be allowed three more logon attempts to the Windows
> 2000 Network because the Local Group Policy and Default Domain Controllers
> Policy cumulatively allow her five bad logon attempts.
>
>
> Explanation:
>
> Jennifer is using a Domain User account, which is impacted by the settings
> the administrator configured in the Default Domain Controllers Policy.
>
>
> My question is, since she is not logging on to a domain controller, I
> thought she wouldn't be affected by the default doamin controllers policy,
> therefore, her account should be locked out.
>
> Am I way off base here or is this a bad question?
>
> --
> I may not be fully certified, but I am fully certifiable.
>
>
>

Relevant Pages

  • Re: Server 2K3 Remote Desktop Access - is this right place?
    ... All roads for that particular error of 'You do not have access to logon to ... On Windows Server 2003, launch GPEDIT.MSC from Start -> Run. ... Drill down and expand the following for Local Computer Policy: ... > Strange - when I activate the Remote Desktop Terminal from the server, ...
    (microsoft.public.win2000.advanced_server)
  • Re: GPO problems when logon to kerberos-realm
    ... when I put the same policy on an OU with e.g. a Windows ... problem when logon to a Terminal Server. ...
    (microsoft.public.windows.group_policy)
  • Re: Stop Certain user accounts logging onto pc??
    ... just put that account into the "Deny Logon ... Locally" list and enable that policy. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: local GPO question
    ... You just had the option of> synchronous or asynchronous policy processing. ... Windows XP lets you wait for the network or not. ... I had understood that turning off Fast logon optimization in>> XP ...
    (microsoft.public.win2000.group_policy)
  • Re: local GPO question
    ... synchronous or asynchronous policy processing. ... Windows XP lets you wait for the network or not. ... > "Note that Windows XP clients support Fast Logon Optimization in any ...
    (microsoft.public.win2000.group_policy)