Which Groups Grant Least Privilege to Add a Windows Server 2022 DC?

Your network contains an Active Directory Domain Services (AD DS) forest. The forest functional level is Windows Server 2012 R2. The forest contains the domains shown in the following table. You create a user named Admin1. You need to ensure that Admin1 can add a new domain controller that runs Windows Server 2022 to the east.contoso.com domain. The solution must follow the principle of least privilege. To which groups should you add Admin1? -

EAST\Domain Admins only Source Reference Answer
CONTOSO\Enterprise Admins only
CONTOSO\Schema Admins and EAST\Domain Admins
CONTOSO\Enterprise Admins and CONTOSO\Schema Admins

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests knowledge of AD DS promotion prerequisites and group privileges, with the common trap being the unnecessary assumption that Enterprise or Schema Admin rights are always required for newer Windows Server versions.

Adding a new domain controller requires understanding AD DS group permissions and functional level requirements. The community consensus confirms that for a Windows Server 2012 R2 forest, only local Domain Admins are needed, adhering strictly to the principle of least privilege.

Option D is frequently chosen because candidates mistakenly believe that deploying a newer Windows Server version always requires running adprep, which would demand both Enterprise Admin and Schema Admin privileges. However, since the forest functional level is already 2012 R2 or higher, no schema update is needed, making Domain Admins sufficient.

Community Discussion (6 comments)

sardonique 👍 1

EAST\Domain Admins is ok, tested in Lab it has successfully promoted to a DC, however it failed to create a DNS delegation on the parent domain. DNS delegation is an option, it is not mentioned in the question. Normally you would want to flag that option upon promotion of a DC in a Child domain. the premises of the question are met with "EAST\Domain Admins only", however you end up in a non optimally configured infrastructure. Yet another badly formulated misleading scenario. In the real world "EAST\Domain Admins only" is not enough, you would need either some admin privileges on the parent domain, or to cooperate with one of the parent domain admins to create the missing DNS delegations

BlackCat9588 👍 3 Selected: A

A. EAST\Domain Admins only

nap61 👍 2 Selected: A

According with this article https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers a WS2022 DC can be installed in a FL 2008 and above without have to prepare de forest. Also is not required to runadprep. And, in this case the minimum to install a 2022DC in a 2012R2 FL would be Domain Admin of the respective domain, so East/Domain Admin.

Kuikz 👍 1 Selected: A

https://u-tools.com/help/UpgradeRunAdprep.asp Before you can replace your old computer with a new computer that is running a new version of Windows Server, you need to first prepare the Active Directory schema by running adprep. The adprep console utility will upgrade the Active Directory schema to add new object types required by the new operating system. If you forget to run adprep, U-Move will display a warning message to remind you. Windows Server 2012-2022: Windows will automatically run adprep during the promotion of the new domain controller.

004b54b 👍 1 Selected: A

As mentionned by NotThatGuy242, according to https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/adprep/changes-made-by-adprep Answer is A

[Removed] 👍 1 Selected: D

The question at hand seems to lack practicality. While Domain Admins of the child domain theoretically possess the ability to add a new domain controller, the Active Directory forest and domain need to be prepared for Windows Server 2022 DC, which mandates permissions from both Enterprise Admins and Schema Admins. In a real-world scenario, it wouldn't be advisable to grant Admin1 the combined permissions of Enterprise Admins and Schema Admins simply to facilitate the addition of a new domain controller in the child domain. However, for the purposes of this hypothetical scenario, we must assume that Admin1 is the sole administrator tasked with this responsibility, thereby requiring the elevated permissions without additional administrative support for forest and domain preparation prior to the addition of the new domain controller. My answer is D

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

When the forest functional level is Windows Server 2012 R2 or higher, Microsoft no longer requires schema extensions to introduce newer domain controllers like Windows Server 2022. Therefore, the minimum permissions needed to promote a server to a DC in a specific domain belong to that domain’s administrators. Adding Admin1 to EAST\Domain Admins provides exactly the rights required to run dcpromo locally, perfectly aligning with the principle of least privilege.

Why the Other Options Are Wrong

Options B, C, and D incorrectly escalate privileges beyond what is necessary. Enterprise Admins and Schema Admins are only required when extending the AD schema or managing cross-forest operations, neither of which applies here. Granting these elevated groups violates the principle of least privilege and introduces unnecessary security risks to the forest.

Community Comment Notes

Multiple verified users confirm that testing in a lab environment successfully promotes a DC using only local Domain Admins [Comment 2]. Experts clarify that legacy adprep steps were eliminated for functional levels 2008 R2 and above, directly supporting Option A [Comment 1, 4]. While one candidate questioned real-world DNS delegation needs, the exam explicitly focuses on baseline promotion permissions rather than optional configuration steps [Comment 2].

Official Reference

Exam Strategy

Always check the forest and domain functional levels first; if they are 2008 R2 or higher, you can skip adprep and assume local Domain Admins are sufficient for DC promotions. Focus on the principle of least privilege by rejecting any option that includes Forest-level or Schema-level groups unless the scenario explicitly mentions schema changes or cross-domain trusts.

Related Analysis

← Back to AZ-801 Study Guide