Your company has an Active Directory domain that has an organizational unit named Sales. The  Sales organizational unit contains two global security groups named sales managers and sales  executives.    
You need to apply desktop restrictions to the sales executives group.    
You must not apply these desktop restrictions to the sales managers group. You create a GPO  named DesktopLockdown and link it to the Sales organizational unit.    
What should you do next（）

多项选择题Your company has an organizational unit named Production. The Production organizational unit  has a child organizational unit named R&D. You create a GPO named Software Deployment and  link it to the Production organizational unit.     You create a shadow group for the R&D organizational unit. You need to deploy an application to  users in the Production organizational unit. You also need to ensure that the application is not  deployed to users in the R&D organizational unit.     What are two possible ways to achieve this goal（）

A.Configure the Enforce setting on the software deployment GPO.
B.Configure the Block Inheritance setting on the R&D organizational unit.
C.Configure the Block Inheritance setting on the Production organizational unit.
D.Configure security filtering on the Software Deployment GPO to Deny Apply group policy for the R&D security group

单项选择题You are installing an application on a computer that runs Windows Server 2008 R2. During  installation， the application will need to add new attributes and classes to the Active Directory  database.     You need to ensure that you can install the application.     What should you do（）

A.Change the functional level of the forest to Windows Server 2008 R2.
B.Log on by using an account that has Server Operator rights.
C.Log on by using an account that has Schema Administrator rights and the appropriate rights to install the applicatio
D.Log on by using an account that has the Enterprise Administrator rights and the appropriate rights to install the app

单项选择题You want users to log on to Active Directory by using a new User Principal Name （UPN）.  You  need to modify the UPN suffix for all user accounts.     Which tool should you use（）

A.Dsmod
B.Netdom
C.Redirusr
D.Active Directory Domains and Trusts

多项选择题You need to relocate the existing user and computer objects in your company to different  organizational units.     What are two possible ways to achieve this goal（）

A.Run the Dsmod utility.
B.Run the Active Directory Migration Tool （ADMT）.
C.Run the Active Directory Users and Computers utility.
D.Run the move-item command in the Microsoft Windows PowerShell utility.

单项选择题Your company hires 10 new employees. You want the new employees to connect to the main  office through a VPN connection. You create new user accounts and grant the new employees  the Allow Read and Allow Execute permissions to shared resources in the main office.     The new employees are unable to access shared resources in the main office. You need to  ensure that users are able to establish a VPN connection to the main office.     What should you do（）

A.Grant the new employees the Allow Full control permission.
B.Grant the new employees the Allow Access Dial-in permission.
C.Add the new employees to the Remote Desktop Users security group.
D.Add the new employees to the Windows Authorization Access security group.