Your network contains an Active Directory forest. The forest contains two domains named contoso.com and east.contoso.com and the servers shown in the following table.
Contoso.com contains a user named User1.
You add User1 to the built-in Backup Operators group in contoso.com.
Which servers can User1 back up?
User1, as a member of the Backup Operators group in the contoso.com domain, can back up both DC1 and Server1. This is because the Backup Operators group grants the user permissions to back up and restore files on both domain controllers and member servers within the same domain. Although DC2 and Server2 are part of the east.contoso.com domain, User1 does not have the same permissions there unless explicitly added to the Backup Operators group in that domain. Therefore, User1 can back up DC1 and Server1 only.
Correct answer: D Members of the Backup Operators group can back up and restore all files on A computer, regardless of the permissions that protect those files. This doesn't means that the member of Backup operators group can backup any computer and not just a Domain controller. They do have the permissions needed to replace files (including operating system files) on domain controllers. Because members of this group can replace files on domain controllers, they're considered service administrators.
It is definitely either D or E. Backup Operators can perform backup/restore operations for domain controllers and member servers. I'm just not sure if they can do this for only members of the root domain, or if those permissions would apply to child domains as well. I believe it would be that domain only.
i agrre with you. But for the child domain, as you can test it, it contain his built-in Backup Operator Group, so the user in the root domain cannot have access to this child domain if he is not member of the child domain built-in security group
the correct answer should be D DC1 and SRV1
Correct “Members of the Backup Operators group can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can log on to and shut down the computer. This group can't be renamed, deleted, or removed. By default, this built-in group has no members, and it can perform backup and restore operations on domain controllers.“
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups Answer is A and credit to matthewk92 for picking out the crucial info
“Members of the Backup Operators group can back up and restore all files on a computer, regardless of the permissions that protect those files." Not only DC's but also member servers and workstation in the same domain. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
Let me highlight: Not only DC's but also member servers and workstation in the same domain. based on that answer is D
DC2 belongs to a different domain, so DC1
Answer D By default, this right is granted to Administrators and Backup Operators on workstations and servers. On domain controllers, Administrators, Backup Operators, and Server Operators have this right.
"Backup Operators" is a built-in group. It's not a domain groups. Child domain also has it's own "Backup Operators" built-in group, so you cannot backup the domain or any other member server of the child domain.
Certmonk is correct, answer is D. Backup Operators can back up any server, including DCs.
valid 27.11.23
Backup Operators can backup DCs and Member Servers
I think that answer is D. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups "Assign user rights to security groups in Active Directory. Assign user rights to a security group to determine what members of that group can do within the scope of a domain or forest. User rights are automatically assigned to some security groups when Active Directory is installed to help administrators define a person’s administrative role in the domain. For example, a user who you add to the Backup Operators group in Active Directory can back up and restore files and directories that are located on each domain controller in the domain. The user can complete these actions because, by default, the user rights Backup files and directories and Restore files and directories are automatically assigned to the Backup Operators group. Therefore, members of this group inherit the user rights that are assigned to that group."
In the given domain the Operator group memebr has the right to complate the task. As DC1 and Server1 sit in the same domain as the user is added to the given Backup operators group answer is D
How would you assign a user permissions to backup only DCs in the single domain? Maybe that and A is the right choice
It is clearly A. "Backup Operators" is a built-in group - this will present as a local group on member servers, and child domains will have their own "Backup Operators" group. See: https://serverfault.com/questions/1061814/how-to-make-domain-user-for-backup-be-part-of-backup-operators-group-on-one-clie
members of the "Backup Operators" group in a domain can back up data on member servers within that domain. The "Backup Operators" group is a built-in group in Windows that has certain privileges related to backing up and restoring files and directories on computers running Windows operating systems.
The Correct answer is A: Backup Operators group, you can only back up and restore files and directories on domain controllers within the domain. this doesn't include member server. I was also confused. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
The Correct answer is C: As a member of the Backup Operators group, you can back up and restore files and directories on all domain controllers within the domain, including child domain controllers. but not member servers. I was also confused. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#backup-operators "By default, this built-in group has no members, and it can perform backup and restore operations on domain controllers." Answer is A.