Microsoft Updated AZ-800 Exam Questions and Answers by reya

Modify the trust on : DC2

Modify the permissions for the : Computer object of SRV1

In an Active Directory Domain Services (AD DS) environment involving multiple forests and external trusts, managing granular access across domain boundaries is achieved through Selective Authentication . According to official documents for Administering Windows Server Hybrid Core Infrastructure, there are two primary authentication settings for a trust: Domain-wide authentication and Se lective authentication .

When you need to restrict users from a trusted forest (contoso.com) so they can only access specific resources in the trusting forest (adatum.com), you must configure the trust to use Selective Authentication . This configuration must be performed in the resource domain (the trusting domain). Based on the provided table, DC2 is the domain controller for adatum.com , which is where the shared resources (SRV1) reside. Therefore, you must modify the trust properties on DC2 to enable Selective Authentication for the incoming trust from contoso.com.

Once Selective Authentication is enabled, Windows does not automatically grant the " Authenticated Users " SID to the user ' s access token for resources in the local domain. Instead, administrators must explicitly grant the Allowed to Authenticate permission on the specific resource ' s computer object. In this scenario, since the requirement is to restrict access specifically to resources on SRV1 , you must modify the security permissions on the Comput er object of SRV1 in Active Directory Users and Computers. By granting the contoso.com users (or a group containing them) this permission, they can successfully authenticate against SRV1 while being blocked from all other servers in the adatum.com forest. This satisfies the requirement to prevent access to any other resources while maintaining the ability of adatum.com users to access contoso.com (as the 2-way trust remains intact).

Step-by-Step Guide: Seizing/Transferring the Schema Master Role to DC2

✅ Step 1: Log in to DC2

Use an account that is a member of the Schema Admins, Enterprise Admins, and Domain Admins groups.

✅ Step 2: Register the Schema Snap-in

The Schema snap-in is not loaded by default.

Open Command Prompt as Administrator.

Type the following command to regist er the schema management DLL:

powershell

Copy

regsvr32 schmmgmt.dll

✅ Step 3: Open MMC (Microsoft Management Console)

Press Windows + R, type mmc, and hit Enter.

In MMC, go to File > Add/Remove Snap-in.

Select Active Directory Schema, then click Add > OK.

✅ Step 4: Connect to DC2

In the Active Directory Schema console, right-click Active Directory Schema and select Change Active Directory Domain Controller.

In the dialog box, select DC2 and click OK.

This will connect the console to DC2.

✅ Step 5: Transfer the Schema Master Role

Right-click Active Directory Schema again and select Operations Master.

In the Change Schema Master dialog box, confirm that DC2 is shown as the target.

Click the Change button to transfer the Schema Master role to DC2.

Click Yes whe n prompted to confirm the transfer.

✅ Step 6: Verify the Transfer

In the same dialog box, ensure that DC2 is now listed as the Schema Master.

Optionally, run the following command in PowerShell to verify:

netdom query fsmo

The Schema Master should now be DC2.