Exam Essentials

Understand what types of accounts can be created.     There are five types of accounts that can be created within Active Directory: User , InetOrgPerson, Contact, Computer, and Group .

Understand the need to uniquely identify accounts.     Account names should identify who the user or computer is to make it easier to understand which accounts are being used and managed.

Know why prefixes for service and temporary accounts are recommended.     Service and temporary accounts should be identified with a prefix so that they can be found easily within the directory.

Understand the group naming strategies.     Group names should include the scope of the group, the group s purpose, and the group s owner.

Know what makes up an account authentication policy.     An authentication policy is made up of the password and lockout policies, as well as the methods used to authenticate it.

Know the settings used within the password policy.     The settings are Enforce Password History, Maximum Password Age, Minimum Password Age, Minimum Password Length, Password Must Meet Complexity Requirements, and Store Password Using Reversible Encryption.

Know the settings used within the lockout policy.     The settings are Account Lockout Duration, Account Lockout Threshold, and Reset Account Lockout Counter After.

Know the resource access strategies that can be employed to give users access to resources.     The three resource access strategies include account/discretionary access control list (A/DACL), account group/discretionary access control list (AG/DACL), and account group/resource group (AG/RG).

Understand the group creation options.     Domain Admins, Account Operators, and Enterprise Admins all have the ability to create and manage groups. You can also delegate the permission to create and manage groups to users who you do not want to add to the membership of these groups.