AZ-800 / Q24 / T1

Goofer

Highly Voted 1 year, 10 months ago 

A GPO linked to the AADDC Users OU has no effect on the local user accounts. You need to link the GPO to the AADDC Computers OU. 

1. AAD DC Administrators group 

2. AADDC Computers organizational unit (OU)

upvoted 25 times 

SuradjBajaj

Highly Voted 1 year, 9 months ago 

Correct, We need to create a Group Policy Object (GPO) in the Azure Active Directory Domain Services (Azure AD DS) domain, configure the GPO's password policy, and link the GPO to the organizational unit (OU) that contains the domain's computer accounts. To administer group policy in a managed domain, you must be signed in to a user account that's a member of the AAD DC Administrators group. There are two built-in Group Policy Objects (GPOs) in a managed domain - one for the AADDC Computers OU, and one for the AADDC Users OU. You can customize these GPOs to configure group policy as needed within your managed domain. By default, the AADDC Computers OU contains all the computer accounts of the member computers.

upvoted 5 times 

Bob0331

Most Recent 3 months ago 

I would think it is the computer GPO as it says local user accounts, not user accounts in aaddc. Only the computer GPO can change the settings for local user accounts

upvoted 2 times 

Bolo92

1 year ago 

valid 27.11.23

upvoted 1 times 

MR_Eliot

1 year, 2 months ago 

Correct answers: 

1. AAD DC Administrators group -> You need this permission to be able to login on the Azure AD domain controller 

2. AADDC Computers organizational unit (OU) -> Password policy, is a computer policy, not a user policy. so this one is right answer.

upvoted 4 times 

syu31svc

1 year, 8 months ago 

https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy Answer is correct

upvoted 2 times 

tomasek88

1 year, 5 months ago 

wrong --> correct is AADDC Computers organizational unit (OU)

upvoted 2 times 

STFN2019

1 year, 10 months ago 

Correct

upvoted 1 times