Who Can Install and Authorize a DHCP Server in a Multi-Domain Forest?
Overview
Contoso, Ltd. is a company that has a main office in Seattle and two branch offices in Los Angeles and Montreal.
Existing Environment
AD DS Environment
The network contains an on-premises Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains two domains named contoso.com and canada.contoso.com.
The forest contains the domain controllers shown in the following table.
All the domain controllers are global catalog servers.
Server Infrastructure
The network contains the servers shown in the following table.
A server named Server4 runs Windows Server and is in a workgroup. Windows Defender Firewall on Server4 uses the private profile.
Server2 hosts three virtual machines named VM1, VM2, and VM3.
VM3 is a file server that stores data in the volumes shown in the following table.
Group Policies
The contoso.com domain has the Group Policies Objects (GPOs) shown in the following table.
Existing Identities
The forest contains the users shown in the following table.
The forest contains the groups shown in the following table.
Current Problems
When an administrator signs in to the console of VM2 by using Virtual Machine Connection, and then disconnects from the session without signing out, another administrator can connect to the console session as the currently signed-in user.
Requirements
Technical Requirements
Contoso identifies the following technical requirements:
Change the replication schedule for all site links to 30 minutes.
Promote Server1 to a domain controller in canada.contoso.com.
Install and authorize Server3 as a DHCP server.
Ensure that User1 can manage the membership of all the groups in Contoso\OU3.
Ensure that you can manage Server4 from Server1 by using PowerShell remoting.
Ensure that you can run virtual machines on VM1.
Force users to provide credentials when they connect to VM2.
On VM3, enable Data Deduplication on all volumes that support the feature.
You need to meet the technical requirements for Server3.
Which users can perform the required tasks?
Community Insight
This question tests the distinction between installing a DHCP role (requires local admin) and authorizing a DHCP server in a multi-domain forest (requires Enterprise Admin), where domain-level admins alone cannot authorize DHCP servers.
In Contoso's two-domain forest (contoso.com and canada.contoso.com), installing and authorizing Server3 as a DHCP server requires both local administrator rights on Server3 and Enterprise Administrator privileges in the forest. Only Admin1, the Enterprise Admin, can complete both the installation and the AD DS authorization of the DHCP server.
Choosing D (Admin1 and Admin3) or E (all three) is a common mistake because learners assume Domain Admins can also authorize a DHCP server in AD DS. In a multi-domain forest, only Enterprise Admins can authorize DHCP servers, so Domain Admins of contoso.com or canada.contoso.com cannot complete the authorization step.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Installing the DHCP server role on Server3 requires membership in the local Administrators group on that server, which Admin1 (Enterprise Admin) satisfies. Authorizing a DHCP server in Active Directory creates an object in the Configuration naming context of the forest, and in a multi-domain forest this operation requires Enterprise Administrator privileges. Since Contoso has two domains (contoso.com and canada.contoso.com), the DHCP authorization step demands the highest tier of forest-wide privilege. Admin1 is the only user who can both install the role locally and authorize the server in AD DS, making A the correct answer.
Why the Other Options Are Wrong
Options B, C, and E fail because Admin2 and Admin3 lack Enterprise Admin privileges necessary to authorize a DHCP server in a multi-domain forest. Domain Admins of either contoso.com or canada.contoso.com have administrative control over their own domain but not over the forest-level Configuration partition where DHCP authorization objects are stored. Even if Admin2 or Admin3 could install the DHCP role on Server3 (if they had local admin rights), the authorization step would fail with access-denied errors because it requires Enterprise Admin privileges in this multi-domain forest scenario.
Community Comment Notes
Multiple community members correctly identified the answer as A, with one noting that "Only enterprise admin has ability to install AND authorize." Another commenter referenced Microsoft documentation stating "you must use the Enterprise Administrator account to authorize the DHCP server" in a multi-domain environment. However, one community member disagreed, claiming "Both Enterprise and Domain Admins can install and authorize" — this is incorrect because Domain Admins in a single domain of a multi-domain forest do not have the permissions to authorize DHCP servers at the forest level.
Exam Strategy
Always distinguish between forest-wide operations and domain-wide operations in multi-domain forest scenarios. DHCP authorization, forest-wide FSMO roles, and creating trusts require Enterprise Admin, while domain-level tasks like creating OUs or users only require Domain Admin of the relevant domain.
Frequently Asked Questions
Why can't Domain Admins authorize a DHCP server in a multi-domain forest?
DHCP server authorization creates an object in the forest's Configuration naming context, which requires Enterprise Admin privileges. Domain Admins only have permissions within their own domain, not at the forest level.
What's the difference between installing and authorizing a DHCP server?
Installing the DHCP role requires local administrator rights on the server. Authorizing it in AD DS prevents rogue DHCP servers by requiring Enterprise Admin privileges in a multi-domain forest.
Related Analysis
Practice All AZ-802 Questions
Access 125 questions with complete answers and detailed explanations.
View Full AZ-802 Practice Test →