Exam MD-100 topic 15 question 1 discussion

User6 is a member of a group that has 'Deny' rights to remote desktop. First step is to remove User6 from the group.

Based on the information in the question, User6 will not be able to connect remotely via Remote Desktop. One of two measures is required for this to happen: 1 - Remove Group2 from Deny access to this computer from the network policy (LGPO or GPO). 2 - Remove User6 from Group2 in the domain. An extra step should still occur which would be any of the alternatives A, C and D. It is mandatory that User6 be part of the Remote Desktop User group (local or domain). Or, as a last resort, breaking the principle of least privilege, add User6 to the administrators group (local or domain). So the answer is B. Then it goes to the extra step.

B is correct ! Deny Access to the computer from the network includes RDP, SMB etc... So user MUST be removed form group 2 in order to connect via RDP.

Correct Answer. Deny over Access.

User6 needs to be added to the Remote Desktop Users group on Computer2. "Note that Deny access to this computer from the network denies only remote SMB connections; it does not prevent interactive logon or RDP access." https://security.stackexchange.com/questions/130208/why-does-disa-stig-recommend-deny-access-to-this-computer-from-the-network-for "Deny log on through Remote Desktop Services" would prevent a user from logging in through Remote Desktop. https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services