Download Microsoft.MD-100.DrunkMonk.2022-05-08.336q.tqb

Mia Hamm reports that Computer1 is not activated. The solution is to perform a local AutoPilot Reset on the computer. This will restore the computer settings to a fully-configured or known IT-approved state. When the user signs in to Computer1 after the reset, the computer should activate. You can use Autopilot Reset to remove personal files, apps, and settings from your devices. The devices remain enrolled in Intune and are returned to a fully- configured or known IT-approved state. You can Autopilot Reset a device locally or remotely from the Intune for Education portal. Incorrect Answers:A: All users have Microsoft 365 E3 licenses. This license includes Windows 10 Enterprise so we don't need to assign a Windows 10 Enterprise license to Mia Hamm. B: Redeploying Computer1 is not required.C: A Volume License Key is not required.References:https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing https://docs.microsoft.com/en-us/intune-education/autopilot-reset

Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose and recover devices. The OEM Windows 10 installation on the new computers can be transformed into a "business-ready" state, applying settings and policies, installing apps, and even changing the edition of Windows 10 being used (e.g. from Windows 10 Pro to Windows 10 Enterprise) to support advanced features. The only interaction required from the end user is to connect to a network and to verify their credentials. Everything beyond that is automated. References:https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot

You can configure one of the computers as a Key Management Service (KMS) host and activate the KMS host by phone. The other computers in the isolated network can then activate using the KMS host. Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers. To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft's activation services. References:https://docs.microsoft.com/en-us/windows/deployment/volume-activation/activate-using-key-management-service-vamt

D: As we have performed a clean installation of Windows 10 without formatting the drives, User1's Windows 8.1 user profile will be located in the \Windows.old folder. Therefore, we need to run scanstate.exe on the \Windows.old folder. E: User1's Windows 10 profile will be in the C:\Users folder so we need to run loadstate.exe to apply the changes in the C:\Users folder.References:https://docs.microsoft.com/en-us/windows/deployment/usmt/usmt-how-it-works https://docs.microsoft.com/en-us/windows/deployment/usmt/usmt-common-migration-scenarios#bkmk-fourpcrefresh

By using the Service1 account as the identity used by Application1, we are applying the principle of least privilege as required in this question. However, the Service1 account could be used by a user to sign in to the desktop on the computer. To sign in to the desktop on the computer, an account needs the log on locally right which all user accounts have by default. Therefore, we can prevent this by assigning Service1 the deny log on locally user right. Incorrect Answers:A: Configuring Application1 to sign in as the Local System account would ensure that the identity used by Application1 cannot be used by a user to sign in to the desktop on Computer1. However, this does not use the principle of least privilege. The Local System account has full access to the system. Therefore, this solution does not meet the goal. C: A service account needs the log on as a service user right. When you assign an account to be used by a service, that account is granted the log on as a service user right. Therefore, assigning Service1 the deny log on as a service user right would mean the service would not function. D: The Local Service Account is a predefined local account used by the service control manager.References:https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/deny-log-on-locally

The BitLocker recovery key is stored in Azure Active Directory. References:https://celedonpartners.com/blog/storing-recovering-bitlocker-keys-azure-active-directory/

References:https://www.online-tech-tips.com/computer-tips/set-file-folder-permissions-windows/

Files and folders are objects and are audited through object access. References:https://www.netwrix.com/how_to_detect_who_changed_file_or_folder_owner.html

In the registry, add a default user name and a default password in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon sbukey. References:https://support.microsoft.com/en-us/help/324737/how-to-turn-on-automatic-logon-in-windows

In Windows Explorer, right-click the C:\Folder1 folder, and then click Properties. Click on the Security tab, and then click Edit. In the Permissions dialog box, add Jon Ross. Specify the Allow Modify permissions for the Jon Ross. Click OK twice to close the Security dialog box. Click OK twice to close the Properties dialog box.References:https://docs.microsoft.com/en-us/iis/web-hosting/configuring-servers-in-the-windows-web-platform/configuring-share-and-ntfs-permissions