SC-100 Certification Practice Question #118

Question

Your network contains an Active Directory Domain Services (AD DS) domain.

You need to ensure that the built-in administrator account for the domain can be used only for interactive sign-ins to domain controllers.

What should you configure?

Accepted Answer

The requirement is to allow the built-in domain Administrator account only for interactive (local) sign-ins to domain controllers. MS Learn's "Appendix D: Securing Built-in Administrator Accounts in Active Directory" prescribes adding the domain Administrator to the Deny logon user rights (Deny access from the network, Deny log on as batch/service, Deny log on through RDS) under Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment — which leaves only interactive console (local) logon to DCs. Critically, the built-in Administrator (RID 500) is exempt from authentication policies and authentication policy silos, so options B and D cannot enforce this for that specific account, and Protected Users (A) governs credential exposure rather than logon location. This makes C the only mechanism that achieves the goal, agreed by both the Suggested Answer and the top community vote. Confidence is held at 90% (not higher) because a vocal minority pushes the "modern" silo answer, but MS Learn is unambiguous that the silo cannot bind RID-500.

More SC-100 practice questions