The built-in Backup Operators group is a domain-local security group. Its permissions are scoped to the domain in which it exists. When a user is added to this group, they are granted the "Back up files and directories" and "Restore files and directories" user rights on all domain controllers and member servers within that specific domain. In this scenario, User1 is added to the Backup Operators group in the contoso.com domain. Therefore, User1 gains backup rights only on the computers within the contoso.com domain, which are DC1 (a domain controller) and Server1 (a member server). The permissions do not extend to the child domain east.contoso.com, so User1 cannot back up DC2 or Server2.

A. DC1 only: This is incorrect. The rights granted to the Backup Operators group apply to all member servers within the domain, not just domain controllers.
B. Server1 only: This is incorrect. The rights granted to the Backup Operators group also apply to all domain controllers within the domain.
C. DC1 and DC2 only: This is incorrect. The permissions of the contoso.com Backup Operators group do not extend to the east.contoso.com domain where DC2 is located.
E. DC1, DC2, Server1, and Server2: This is incorrect. The group's permissions are limited to the contoso.com domain and do not apply to any servers in the east.contoso.com domain.

1. Microsoft Learn

"Active Directory security groups": This document describes the default security groups in Active Directory. For the Backup Operators group

it states

"Members can back up and restore files on a computer

regardless of the permissions that protect those files." The context of these built-in groups is that their scope is the domain in which they are created.

Reference: Microsoft Learn. (n.d.). Active Directory security groups. Retrieved from https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#backup-operators

Section: "Default security groups"

Subsection: "Backup Operators".

2. Microsoft Learn

"Back up files and directories": This document details the "Back up files and directories" user right (SeBackupPrivilege). It specifies the default security settings for this right on different Windows Server versions. For domain controllers

this right is assigned by default to the Administrators and Backup Operators groups via the Default Domain Controllers Policy

which is linked to the Domain Controllers OU within its own domain.

Reference: Microsoft Learn. (n.d.). Back up files and directories. Retrieved from https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories

Section: "Default values".

3. Microsoft Learn

"Default local groups": This article explains the purpose of default groups. While it discusses local groups

it clarifies their role within an Active Directory domain. The Backup Operators group in the Builtin container of a domain grants rights on computers within that domain.

Reference: Microsoft Learn. (n.d.). Default local groups. Retrieved from https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/default-local-groups

Section: "Backup Operators".