Exam AZ-104 topic 1 question 21 discussion

Ans: A After Windows is installed but before the logon screen appears, Windows Setup searches for the SetupComplete.cmd file in the %WINDIR%\Setup\Scripts\ directory

GPOs aren't a thing in Azure AD. Just putting a Script inside the VHD doesn't make it run on boot. Configuring a "SetupComplete.cmd" in the "%windir%\setup\scripts" directory is the correct approach:

SetupComplete.cmd is a special batch file that runs automatically after Windows Setup completes, but before a user logs on for the first time. This makes it ideal for automating tasks like running PowerShell scripts on newly provisioned VMs. It ensures the scripts are executed once, immediately after setup, which is typically what you want for initial configuration tasks. This method is independent of Group Policy, which may not apply immediately or reliably to new machines, especially in hybrid environments.

C is correct

GPO on startup, ensure script runs on startup.

Ans: C

Given your scenario, the best solution would be: C. Configure a Group Policy Object (GPO) to run the scripts as startup scripts. Here's why: 1.Startup scripts are executed when the machine boots up, ensuring that the configuration scripts run before any user logs in. This is particularly useful for setting up system-level configurations that need to be in place before the VM is fully operational. 2.Logon scripts (option B) run when a user logs in, which might not be ideal for initial VM setup tasks. 3.SetupComplete.cmd (option A) is typically used for tasks that need to be performed after Windows Setup completes, but it might not cover all scenarios for ongoing VM creation and configuration. 4.Placing scripts in a new VHD (option D) is not a standard method for ensuring scripts run automatically on new VMs. Configuring a GPO for startup scripts provides a reliable and centralized way to manage and automate the execution of your PowerShell scripts across multiple VMs.

For me the answer is A. The machine to login to the domain needs to be register in the domain that the GPO will be working. For me Put the script in the location will start them automatically. Independence on login to the domain or not.

The best solution in this scenario would be A: Configure a SetupComplete.cmd batch file in the %windir%\setup\scripts directory. This method ensures that your PowerShell scripts are automatically executed after the Windows setup process is complete, making it ideal for automating the configuration of newly created VMs. The SetupComplete.cmd file runs immediately after the Windows installation is finalized and before the system restarts, allowing you to automate tasks like running your scripts without needing manual intervention. Options B and C (Group Policy Objects for logon or startup scripts) might not be ideal in this case, as they depend on user logons or startup events, which can introduce delays or inconsistencies, especially in environments where VMs are being rapidly deployed. Option D (placing scripts in a new VHD) is not specifically designed for automating VM configuration; it would involve additional steps for accessing and executing the scripts.

Los startup scripts se ejecutan antes de que cualquier usuario inicie sesión, asegurando que la configuración se aplique correctamente a todas las nuevas VMs cuando se inicien. Además, este enfoque se administra centralmente desde Active Directory, lo que facilita la aplicación en múltiples máquinas.

You have created some PowerShell scripts to automate the configuration of newly created VMs. You need a solution that ensures the scripts are run on the new VMs. There is nothing to imply that the script needs to be run on every startup. Therefore there is no reason to use a GPO. SetupComplete.cmd would be the appropriate answer.

Nowhere in the question is written that the new VMs will be domain joined. So GPO may not be an option at all.

The best solution is C. Configure a Group Policy Object (GPO) to run the scripts as startup scripts. This ensures that the PowerShell scripts are executed when the VMs start up, automating the configuration process effectively

I think A because here: https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-a-custom-script-to-windows-setup?view=windows-11 you could find this: "If the computer joins a domain during installation, the Group Policy that is defined in the domain is not applied to the computer until Setupcomplete.cmd is finished. This is to make sure that the Group Policy configuration activity does not interfere with the script."

Microsoft Entra ID does not support traditional Group Policy Objects (GPOs) like Active Directory Domain Services (AD DS). GPOs are a legacy feature of on-premises Active Directory environments,

Para asegurarse de que los scripts de PowerShell se ejecuten automáticamente en las nuevas VM y configuren el sistema correctamente, la mejor opción es usar un GPO configurado para ejecutar los scripts como scripts de inicio. ✅ Opción correcta: C. Configure un objeto de política de grupo (GPO) para ejecutar los scripts como scripts de inicio.

The SetupComplete.cmd mechanism is executed during Windows Setup after installation completes. This is useful for initial image configuration but is less flexible if you plan to use an already prepared image or if the VMs are deployed in various scenarios over time. Since your environment is domain-joined (as indicated by the hybrid coexistence with on-premises Active Directory) and you’re creating multiple new VMs, using a GPO with startup scripts is a centralized and scalable way to ensure your configuration scripts run automatically on each new VM.