1.7 - Windows editions, domains and Group Policy
CompTIA A+ Core 2 objective 1.7 covers Windows editions and how corporate machines are managed. Only Windows Pro (and higher) can join a corporate domain and enable BitLocker - Windows Home cannot. Following least privilege, an ordinary office user should have a standard user account, not administrator. A domain is centrally managed through a directory, unlike a peer-to-peer workgroup. Group Policy pushes settings and restrictions to domain computers centrally, and the gpresult command shows which policies were applied to the current user or computer. You should tell a workgroup from a domain and pick the right edition or tool. Expect scenario questions about joining a domain, restricting users, or confirming which policy is applied. Choosing Windows Home when the user needs to join a domain or use BitLocker is a classic wrong answer to rule out.
Join a domain + BitLocker = Windows Pro (not Home). Normal user = standard account (least privilege). Central management via a directory = domain (vs workgroup). Push settings to domain PCs = Group Policy; check applied policy = gpresult.
Practice questions
1. Following least privilege, which account type should a standard office user have for daily work?
- Administrator
- Standard user (correct answer)
- Guest with no password
- Domain admin
Daily work should use a standard (non-admin) account; elevate only when needed. This limits malware impact.
2. A user needs to join a corporate domain and enable BitLocker. Which Windows edition is required at minimum?
- Windows Home
- Windows Pro (correct answer)
- Windows S mode
- Windows IoT
Domain join, Group Policy and BitLocker require Windows Pro (or higher). Home lacks these features.
3. Which Windows feature pushes settings and restrictions to domain computers centrally?
- Task Manager
- Group Policy (correct answer)
- Disk Cleanup
- Snipping Tool
Group Policy (GPO) centrally enforces security and configuration on domain-joined machines.
4. What is the key difference between a workgroup and a domain?
- Workgroups encrypt all their traffic
- A domain is centrally managed via a directory (correct answer)
- Domains provide no built-in security
- A workgroup supports thousands of PCs
A domain centralizes authentication and policy via a directory (AD); a workgroup is decentralized peer-to-peer with local accounts.
5. Which command displays the Group Policy results applied to the current user/computer?
- gpupdate
- gpresult (correct answer)
- ipconfig
- tasklist
gpresult (e.g., /r) reports which GPOs are applied. gpupdate refreshes/applies policy.
6. On a public Wi-Fi, which Windows network profile should a laptop use for the strictest firewall rules?
- Domain
- Public (correct answer)
- Private
- Home
Choosing the Public profile applies the strictest firewall rules and disables discovery/sharing — correct for untrusted Wi-Fi.