Discussion Locked

Question from exam prep software

0 helpful
12 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Before adding JennyW2KP to the XYZDimensions.edu Domain, you use the Local Group Policy MMC snap-in on JennyW2KP and configure the account lockout policy to lock out Jennifer's local user account after three bad logon attempts. Afterwards, you configure the Default Domain Controllers Policy to lockout Jennifer's Domain Account after two bad logon attempts.

What will be Jennifer's result if she attempts to logon to the Windows 2000 Network using her Domain Logon account and providing an invalid password both times?

The exam prep software says that the correct answer is Jennifer will be allowed three more logon attempts to the Windows 2000 Network because the Local Group Policy and Default Domain Controllers Policy cumulatively allow her five bad logon attempts.

Is this answer correct?

Thank you,
Ruth Ann

12 replies

by timthetoolman

Hi,

I've cut and pasted a section from the following site below.

http://rr.sans.org/win2000/group_policy.php

The rule is policy settings are inherited and overwritten. I've never seen anything to suggest some are cumulative. I believe the answer may be wrong but I would be interested if anyone else has another view on that!

"Policy Processing - It is important to understand how Windows 2000 processes policies. Policies are processed in a hierarchy:
1. Local GPO?s - these policies are local to a computer, which can be set on any Windows 2000 computer, regardless of its participation in a domain
2. GPO?s applied to Sites
3. GPO?s applied to the Domain
4. GPO?s applied to OU?s

When policies are applied, they overwrite those previously applied. Considering the above order of precedence, policies applied at the local level will be overwritten by domain policies when joining the domain. Policies applied at the OU in which the user or computer is placed will be applied last (and therefore be implemented)."

Cheers,
Tim.

by timthetoolman

Hi,

Like the other question... can you please post the exact wording of the answer? Again, a paraphrased answer may contain an error in itself...

Cheers,
Tim.

by iamruthann

Jennifer is an employee of a company called XYZ Dimensions Inc. located in Chicago. Jennifer is currently using a stand-alone Windows 2000 Professional workstation, named JennyW2KP, to use a locally installed graphics editing application. As the administrator, you are going to add JennyW2KP to the Windows 2000 Domain, named XYZDimensions.edu, which currently consists of one Windows 2000 Server Domain Controller and four Windows 2000 Professional workstations.

Before adding JennyW2KP to the XYZDimensions.edu Domain, you use the Local Group Policy MMC snap-in on JennyW2KP and configure the account lockout policy to lock out Jennifer's local user account after three bad logon attempts. Afterwards, you configure the Default Domain Controllers Policy to lockout Jennifer's Domain Account after two bad logon attempts.

What will be Jennifer's result if she attempts to logon to the Windows 2000 Network using her Domain Logon account and providing an invalid password both times? Select the correct answer.

A . Jennifer will be locked out of the Windows 2000 Network for a configured amount of time designated by the administrator.

B*. Jennifer will be allowed three more logon attempts to the Windows 2000 Network because the LocalGroup Policy and Default Domain Controllers Policy cumulatively allow her five bad logon attempts.

C . Jennifer will be allowed one more logon attempt to the Windows 2000 Professional machine because the Local Group Policy allows her three bad logon attempts.

D . Jennifer will be allowed one more logon to the Windows 2000 Network because the Local Group Policy overrides the Group Policy

Explanation:
Jennifer is using a Domain User account, which is impacted by the settings the administrator configured in the Default Domain Controllers Policy.

by timthetoolman

Hi,

OK... I think their answer is right now.
And the answer does come from the seemingly innocuous first paragraph because it puts the operation into context.

I haven't ever seen the behaviour myself, but I'm willing to believe that because the entry was placed into the local group policy of her workstation using her local account (she wasn't part of the domain at this point, remember), then further additions in the domain policy (using her domain account now), that the two policies could be cumulative.

They apply to different accounts.

If anyone else has other ideas I'd like to hear them, though.

Cheers,
Tim.

by timwalsh

I would try some different test prep software because this answer is wrong. Yhe correct answer is A (she is locked out). The key is that she is logging into the Win2K domain.. The default domain policy will apply. Also Microsoft specifies that whenever the domain and local group policy conflict, the domain policy will override the local policy.

by frussoniello

Their answer does make sense. She would be locked out after the 2 attempts using her Domain logon. But she can still try to logon locally and have the 3 attempts as indicated by the local policy. It's a separate account, therefore the domain policy wouldn't override the local policy here.

by vigo98

Answer 4 is the most correct here. And I have proved it in my lab. After 2 attempts, your domain account gets locked out, but you can still try three times to log on localy.
Note: if you succesfully logon localy while your domain account id locked out, you can't use the network resources in that domin untill the lockout is over.
Vitor

This discussion is closed to new replies.