单项选择题
A. In Active Directory Users and Computers, open the properties for Andrew's user account. View the Auditing tab of the Advanced Security Setting dialog box for his account.
B. In Windows Explorer, open Contracts. Add the Owner column for the file pane. Search for files that list Andrew as the owner.
C. On TK1, use WordPad to open C:\windows\system32\config\SecEvent.evt. Search for entries that contain Adrew's user account.
D. Edit the Group Policy object (GPO) for the Servers OU. Add Andrew's user account to the Generate security audits Group Policy option.
E. In Event Viewer, apply a filter to display only events that contain Andrew's user account in the User field.
单项选择题 You are the network administrator for The network consists of a single Active Directory domain named The TestKing Staff department has a Windows 2003 computer that functions as a file server. The computer contains a folder named TestKingData. Auditing is enabled on the TestKingData folder. The TestKing Staff department reports that confidential files were deleted from the folder. You need to identify the user who deleted the confidential files. What should you do?（）
单项选择题 You are the network administrator for The network consists of a single Active Directory domain named All five domain controllers run Windows Server 2003, and all client computers run Windows XP Professional. The domains audit policy ensures that all account logon events are audited. A temporary employee named King uses a client computer named TestKing1. When Kings temporary assignment concludes, his employment is terminated. Now you need to learn the times and dates when King logged on to the domain. You need to accomplish this goal by reviewing the minimum amount of information. What should you do?（）
单项选择题 You are the network administrator for the Berlin office of The company network consists of a single Active Directory domain named The Berlin office contains 15 file servers that contain confidential files. All the file servers run either Windows Server 2003 or Windows 2000 Server. All the file servers are in the BerlinFilePrint organizational unit (OU). TestKings security department sets a rule that specifies the size and retention settings for the Security event log of all file servers. The rule also specified that local administrators on servers cannot override the changes you make to the settings for the Security event log. You need to define a method to modify the Security event log settings on each file server in the Berlin office in order to meet the states requirements. What should you do?（）