The correct answer is c. in VS .NET

Create QR in VS .NET The correct answer is c.

Requirement 2 indicates that you want to force users to change their password as quickly as possible. You know that user accounts include the flag User Must Change Password At Next Logon. 1. What will be the fastest and most effective means to configure user accounts to require a password change at the next logon a. Select a user account. Open its properties and, on the Account page, select User Must Change Password At Next Logon. Repeat for each user account. b. Press CTRL+A to select all users in the Employees OU. Choose the Properties command and, on the Account page, select User Must Change Password At Next Logon. Repeat for each OU. c. Use the DSADD command. d. Use the DSRM command. e. Use the DSQUERY and DSMOD commands.

2. The DSQUERY command allows you to create a list of objects based on those objects locations or properties, and pipe those objects to the DSMOD command, which then modifies the objects. Open a command prompt and type the following command:

DSQUERY user "OU=Employees,DC=Contoso,DC=Com"

The command will produce a list of all user objects in the Employees OU. An advantage of this command is that it would include users in sub-OUs of the Employees OU. The requirement indicates that you have 15 OUs under the Employees OU. All would be included in the objects generated by DSQUERY. Now, to meet the requirement, type the following command:

3-50

3

This requirement suggests that you modify the user profiles of the sales representatives. 1. What type of profile will be most useful to maintain a locked-down desktop com mon to all sales representatives a. Local profile b. Local, mandatory profile c. The All Users profile d. Preconfigured roaming group profile e. Preconfigured roaming mandatory group profile

2. In Lesson 3, Exercise 5, you created a profile called Sales. You made it a manda tory profile by renaming Ntuser.dat to Ntuser.man. Finally, you assigned it to sev eral users. How can you ensure that each new sales representative utilizes the same profile

Modify the Sales Representative template account you created in Lesson 2, Exercise 1. On the Profile tab, type the profile path: \\server01\profiles\sales. Confirm the success of your work by copying the template to create a new user account; then log on as that user. Make modifi cations to the desktop, log off, and log on again. The changes you made to the profile do not persist between sessions.

In this lab, you will generate several types of logon and account-related failures. You will then identify the causes of those failures and correct them accordingly. Before proceeding with this lab, you must have user accounts created. The user accounts mentioned in the lab are those generated in Lesson 2, Exercise 3. You must also have configured the domain account policies as in Lesson 4, Exercise 1.

1. Log off of Server01. 2. Generate an account lockout by logging on six times with the username lsmithbates and an invalid password. Notice the difference between the Logon Messages you receive after the attempts and the Logon Message you receive after the account has been locked out.

3

3-51

5. Press CTRL+ALT+DELETE and try to change the password to the original pass-

3-52

3

Summary

You must be a member of the Enterprise Admins, Domain Admins, or Account Operators groups, or you must have been delegated administrative permissions to create user objects. User objects include the properties typically associated with a user account, including logon names and password, and the unique SID for the user. They also include a number of properties related to the individuals they represent, including personal information, group membership, and administrative settings. Windows Server 2003 allows you to change some of these properties for multiple users, simultaneously. A user object template is an object which is copied to produce new users. If the template is not a real user, it should be disabled. Only a subset of user properties are copied from templates. The CSVDE command enables you to import directory objects from a commadelimited text file. Windows Server 2003 supports powerful new command-line tools to create, manage, and delete directory objects: DSQUERY, DSGET, DSADD, DSMOVE, DSMOD, and DSRM. Frequently, DSQUERY will produce a result set of objects that can be piped as input to other commands. Windows Server 2003 provides individual profiles for each user who logs on to the system. Profiles are stored, by default, on the local system in %Systemdrive% \Documents and Settings\%Username%. Roaming profiles require only a shared folder, and the profile path configured in the user object s properties. Preconfigured profiles are simply profiles that are copied to the profile path before the profile path is configured in the user object. Group profiles must be made mandatory, by renaming Ntuser.dat to Ntuser.man, so that changes made by one user do not affect other users. The Default Domain Policy drives account policies including the password and lockout policies, whereas the Default Domain Controllers Policy specifies key auditing policies for domain controllers. Auditing for authentication generates events in each domain controller s security logs.