R01.08.01.02 · TASK CLASS

Directory, identity & remote support

Manage users and groups in AD/Entra/Okta and resolve a user issue over a remote-support session.

20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.

Typical applications: Active Directory · Entra admin · Okta · Remote Desktop
Class GUI-need label: HY · Hybrid

Digital-employee context

Project class assignments, not demonstrated employee capability or imported benchmark coverage. Acceptance criteria and value metrics are proposals; no ROI has been measured.

Related roles

IT and software delivery · Separate deliverables cover service tickets, restored configuration, identity records, repository fixes, passing CI and release packages.

Compare all digital-employee workflow designs

Task proposals · 20

Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.

R01.08.01.02-T01 Onboard a new hire in Active Directory Users and Computers from an HR form

Original instruction

Using ADUC on the lab domain controller (RDP session), create the user described in `C:\input\hr_form_0147.pdf` in OU `Staff/Finance`: names, sAMAccountName per the naming rule in the form, title, department, manager, office phone, groups `FIN-Users` and `VPN-Users`, initial password from the form, and 'User must change password at next logon'.

Platforms: win · Windows
Applications: Active Directory Users and Computers · Remote Desktop
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 2 / 5

Proposed verifier

Get-ADUser -Properties *: DN in OU=Finance,OU=Staff; 9 attributes equal the form; memberOf has both groups; pwdLastSet=0. Script-block logging and Sysmon on the DC detect AD cmdlets, dsadd, net user or ldifde, so the account must come from ADUC in the RDP session, not PowerShell (see control pair T16).

Proposed partial credit

20% account in right OU; 40% attributes (scaled); 20% groups; 20% password flags

R01.08.01.02-T02 Offboard a departing employee in AD without deleting the account

Original instruction

Ticket HR-2291: `jmarsh` (synthetic) leaves today. In ADUC: disable the account, move it to OU `Disabled/2026`, remove all group memberships except Domain Users, set Description to `Offboarded HR-2291 2026-10-14`, and set msExchHideFromAddressLists to TRUE in Attribute Editor. Do not delete the account.

Platforms: win · Windows
Applications: Active Directory Users and Computers · Remote Desktop
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 3 / 5

Proposed verifier

Account exists, userAccountControl has ACCOUNTDISABLE; DN in OU=2026,OU=Disabled; memberOf empty (primary group Domain Users); description exact; msExchHideFromAddressLists TRUE; no other user modified (whenChanged diff on OU). Script-block logging and Sysmon on the DC detect AD cmdlets, dsmod/dsmove or ldifde; any such use voids the task.

Proposed partial credit

25% disabled; 20% moved; 25% groups stripped; 30% description and GAL hide

R01.08.01.02-T03 Create a fine-grained password policy for privileged accounts

Original instruction

In Active Directory Administrative Center on the lab DC, create Password Settings Object `PSO-Admins` with precedence 10: minimum length 16, history 24, max age 60 days, lockout after 5 attempts for 30 minutes, complexity on, reversible encryption off. Apply it to group `Tier0-Admins`.

Platforms: win · Windows
Applications: Active Directory Administrative Center · Remote Desktop
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 2 / 5

Proposed verifier

Get-ADFineGrainedPasswordPolicy PSO-Admins: Precedence 10, MinPasswordLength 16, PasswordHistoryCount 24, MaxPasswordAge 60.00:00:00, LockoutThreshold 5, LockoutDuration and ObservationWindow 00:30:00, ComplexityEnabled true; AppliesTo = Tier0-Admins; Get-ADUserResultantPasswordPolicy for a member returns it. Script-block logging detects AD cmdlets run outside ADAC (dsac.exe host) or ldifde, voiding the task.

Proposed partial credit

50% policy values; 30% applied to group; 20% resultant policy verified

R01.08.01.02-T04 Author a report-only Conditional Access policy for a finance group

Original instruction

In the Microsoft Entra admin center of the test tenant, create Conditional Access policy `CA-Finance-MFA` in Report-only: users = group `Finance`, excluding break-glass account `bg-admin@lab.onmicrosoft.com`; target all cloud apps except app `Legacy-Timesheet`; grant access requiring MFA; sign-in frequency 12 hours.

Platforms: web · Any OS (web)
Applications: Entra admin center
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

Graph identity/conditionalAccess/policies: state enabledForReportingButNotEnforced; includeGroups Finance id; excludeUsers bg-admin id; includeApplications All with excludeApplications Legacy-Timesheet appId; builtInControls mfa; signInFrequency 12 hours.

Proposed partial credit

20% state report-only; 30% users/exclusion; 25% apps/exclusion; 25% grant+session

R01.08.01.02-T05 Automate group membership and app assignment with an Okta group rule

Original instruction

In the Okta developer sandbox org, create group `Sales-All`, a group rule that adds users whose `department` equals `Sales` and `employeeType` is not `Contractor`, activate it, and assign the SAML app `CRM-Sandbox` to the group. Verify that seeded user `pat.lee@sandbox.test` lands in the group.

Platforms: web · Any OS (web)
Applications: Okta
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Okta API /groups/rules: rule ACTIVE with expression matching department and employeeType logic; /groups/{id}/users contains pat.lee and excludes the seeded contractor in Sales; /apps/{CRM}/groups includes Sales-All.

Proposed partial credit

20% group; 40% rule expression correct and active; 20% app assigned; 20% membership verified

R01.08.01.02-T06 Fix a missing mapped drive over a locked-down RDP session

Original instruction

User `kchen` (synthetic) says drive S: disappeared. Connect to their test PC through the provided Remote Desktop session (clipboard and drive redirection disabled). Re-map S: to `\\fs01\shared\Projects` so it persists across sign-ins and reconnect at logon, using the user's existing credentials. Leave other drives as they are.

Platforms: win · Windows
Applications: Remote Desktop · File Explorer
Interfaces: desk · Desktop GUI
GUI need · task setting: G3 · GUI-only
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

On the target PC, HKCU\Network\S RemotePath \\fs01\shared\Projects in kchen's hive; after forced sign-out/in, S: is accessible; other mapped drives unchanged. The PC is reachable only through the RDP framebuffer: WinRM, admin shares and clipboard/drive redirection are disabled.

Proposed partial credit

50% S: mapped correctly; 30% persistent after re-login; 20% other drives untouched

R01.08.01.02-T07 Resolve an Outlook profile issue through a Quick Assist screen share

Original instruction

A simulated user on a test PC starts a Quick Assist session and shares their screen view-only. Request control (the scripted user accepts), then fix their classic Outlook so the shared mailbox `support@lab.test` appears in the folder pane and their signature `Sig-2026` applies to new messages. End the session when done.

Platforms: win · Windows
Applications: Quick Assist · Outlook
Interfaces: desk · Desktop GUI
GUI need · task setting: G3 · GUI-only
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: licensed · Licensed pro app xdevice · Cross-device
Proposed difficulty: 4 / 5

Proposed verifier

On the user PC: Outlook profile has the shared mailbox added (additional mailbox entry in profile registry); NewSignature = Sig-2026; Quick Assist session log shows a control request accepted and session ended. The user PC is reachable only through the Quick Assist stream (no RDP, WinRM or file shares).

Proposed partial credit

20% control obtained; 40% shared mailbox added; 30% signature default; 10% session ended

R01.08.01.02-T08 Fix a user's paused print queue over macOS Screen Sharing

Original instruction

Through Screen Sharing to the remote test Mac of user `amora`, resolve 'nothing prints': the queue `Floor3-MFP` is paused and the default printer was switched to a PDF writer. Resume the queue, set `Floor3-MFP` as default, set its defaults to two-sided and grayscale, and print `~/Documents/test_page.pdf`.

Platforms: mac · macOS
Applications: Screen Sharing · System Settings
Interfaces: desk · Desktop GUI
GUI need · task setting: G3 · GUI-only
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

On the remote Mac: `lpstat -p Floor3-MFP` enabled/idle; `lpstat -d` Floor3-MFP; lpoptions sides=two-sided-long-edge and ColorModel Gray; the CUPS test backend received a job for test_page.pdf with those options. The Mac is reachable only through the Screen Sharing framebuffer: Remote Login (SSH), ARD scripting and clipboard sync are disabled.

Proposed partial credit

30% queue resumed; 25% default; 25% duplex+gray; 20% job received

R01.08.01.02-T09 Find a lockout source in DC logs, then unlock and reset the account

Original instruction

User `rpatel` (synthetic) is locked out repeatedly. On the lab DC, use Event Viewer's Security log to find the computer generating the 4740 lockouts, write it to `C:\triage\lockout_source.txt`, then in ADUC unlock the account and reset the password to the value in the ticket with 'must change at next logon'.

Platforms: win · Windows
Applications: Event Viewer · Active Directory Users and Computers
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: nav · Pan/zoom/scroll vis · Visual judgment click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

lockout_source.txt equals the seeded Caller Computer Name (one of 3 lockout events for the user, decoy events for others); account lockoutTime 0; pwdLastSet 0 and password equals ticket (test bind succeeds then requires change). Script-block logging and Sysmon on the DC detect wevtutil, Get-WinEvent, Unlock-ADAccount, Set-ADAccountPassword or net user; any such use voids that milestone.

Proposed partial credit

40% lockout source; 30% unlocked; 30% password reset with flag

R01.08.01.02-T10 Delegate password resets on one OU to a helpdesk group

Original instruction

Using the Delegation of Control Wizard in ADUC, give group `Helpdesk-T1` the ability to reset passwords and force password change at next logon for user objects in OU `Students` only. Do not grant full control or rights on other object types.

Platforms: win · Windows
Applications: Active Directory Users and Computers
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: click · Point & click nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

`dsacls OU=Students,...` shows Helpdesk-T1 ACEs: Reset Password extended right and write pwdLastSet, inherited to descendant user objects only; no other new ACEs on this or other OUs; a Helpdesk-T1 test account can reset a student password but not a staff one. Sysmon and script-block logging detect dsacls grants, Set-Acl on AD: paths or ADSI ACL edits by the agent; such runs fail.

Proposed partial credit

40% reset password right; 30% pwdLastSet write; 30% scope limited (no extra ACEs)

R01.08.01.02-T11 Revoke access for a departing user in Entra and Microsoft 365 admin

Original instruction

For synthetic user `dlopez@lab.onmicrosoft.com` in the test tenant: revoke all sign-in sessions, block sign-in, remove all licenses, convert their mailbox to a shared mailbox, and give `manager1@lab.onmicrosoft.com` Full Access to it. Stop before deleting the user.

Platforms: web · Any OS (web)
Applications: Entra admin center · Microsoft 365 admin center
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky multiapp · Multi-app
Proposed difficulty: 4 / 5

Proposed verifier

Graph user accountEnabled false, signInSessionsValidFromDateTime after task start, assignedLicenses empty; Exchange Get-Mailbox RecipientTypeDetails SharedMailbox; Get-MailboxPermission shows manager1 FullAccess; user not deleted.

Proposed partial credit

40% sessions revoked and sign-in blocked; 20% licenses removed; 25% shared mailbox; 15% delegation

R01.08.01.02-T12 Diagnose a denied Okta sign-in from the System Log and fix the zone

Original instruction

Sandbox user `mgreen@sandbox.test` cannot sign in from the branch office. Use the Okta System Log to find which policy and rule denied the sign-in, record them in `answer.json` (keys `policy`, `rule`, `reason`), then add the branch office CIDR shown in the denied event to network zone `Corp-Offices` so the sign-in policy allows it.

Platforms: web · Any OS (web)
Applications: Okta
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: nav · Pan/zoom/scroll vis · Visual judgment click · Point & click type · Text & forms
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

answer.json policy/rule names equal the seeded denying rule; reason mentions network zone; /zones Corp-Offices gateways include the exact CIDR and no broader range; a scripted sign-in from that IP now succeeds; other zones unchanged.

Proposed partial credit

40% correct policy/rule; 20% reason; 40% zone fixed precisely

R01.08.01.02-T13 Repair an app setting through a published app on a remote session host

Original instruction

The legacy claims app is only reachable as a published RemoteApp from the lab RD Web portal (no desktop, no file access). Sign in with the test account, open the app, and in its Tools > Options dialog set the server to `claims-db02`, timeout to 60 s and default printer mapping off; then process the queued test claim CL-0042.

Platforms: win · Windows web · Any OS (web)
Applications: Remote Desktop · RD Web Access
Interfaces: desk · Desktop GUI brow · Browser
GUI need · task setting: G3 · GUI-only
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms vis · Visual judgment
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

Session host app settings (per-user config in the host profile) show server claims-db02, timeout 60, printer mapping off; claims DB row CL-0042 status Processed by the test user. The host is reachable only through the RemoteApp window (no full desktop, drive redirection or WinRM).

Proposed partial credit

20% app launched; 50% three settings (scaled); 30% claim processed

R01.08.01.02-T14 Audit nested membership of a VPN group and remove a stale nested group

Original instruction

Using ADUC (Members/Member Of tabs), determine every user who effectively belongs to `VPN-Users` through any level of nesting and write their sAMAccountNames, sorted, one per line, to `C:\triage\vpn_effective.txt`. Then remove the nested group `Contractors-Old` from `VPN-Users`.

Platforms: win · Windows
Applications: Active Directory Users and Computers
Interfaces: desk · Desktop GUI
GUI need · task setting: G2 · GUI-essential
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: click · Point & click nav · Pan/zoom/scroll type · Text & forms
Work product: WP12 · Answer/decision
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

File equals the effective member set computed at setup (3 nesting levels, a cycle, and disabled users included as members); after removal, Contractors-Old not in VPN-Users member; no other membership changed. Script-block logging and Sysmon on the DC detect Get-ADGroupMember, dsget or LDAP query tools, which void the list milestone.

Proposed partial credit

60% effective list (F1-scaled); 30% stale group removed; 10% no collateral changes

R01.08.01.02-T15 Set up a time-bound eligible admin role with Entra PIM

Original instruction

In the test tenant's Entra admin center, make `ops1@lab.onmicrosoft.com` eligible (not active) for the User Administrator role for 6 months. Configure the role's PIM settings: max activation 4 hours, require MFA and justification on activation, require approval by `secops-approvers`, and notify `secops@lab.test` on activation.

Platforms: web · Any OS (web)
Applications: Entra admin center
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

Graph roleEligibilitySchedules: principal ops1, roleDefinition User Administrator, end ~6 months; no active assignment. unifiedRoleManagementPolicy rules: Expiration_EndUser_Assignment PT4H; Enablement MultiFactorAuthentication+Justification; Approval with secops-approvers; Notification recipient.

Proposed partial credit

30% eligible assignment; 25% activation duration; 25% MFA+justification+approval; 20% notification

R01.08.01.02-T16 Control pair of T01: onboard the same hire with PowerShell

Original instruction

Control pair of T01. Onboard the user from `C:\input\hr_form_0147.pdf` (same attributes, OU, groups and password flags) using the ActiveDirectory PowerShell module only, from a WinRM session to the DC.

Platforms: win · Windows
Applications: PowerShell · ActiveDirectory module
Interfaces: term · Terminal
GUI need · task setting: CL · CLI-sufficient
GUI need · ordinary access: CL · CLI-sufficient
Interaction primitives: code · Code & commands
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 2 / 5

Proposed verifier

Same attribute checks as T01; creation event shows powershell/wsmprovhost as the process.

Proposed partial credit

20% OU; 40% attributes; 20% groups; 20% flags

R01.08.01.02-T17 Restore meeting audio for a remote Mac user over Screen Sharing

Original instruction

User `lwong` (synthetic) on a remote test Mac says nobody hears them in the sandbox meeting app `MeetLite`. Over Screen Sharing: set input to the `USB Headset` device at 70% input volume, grant MeetLite microphone access in Privacy & Security, and run MeetLite's mic test until it shows 'Mic OK'.

Platforms: mac · macOS
Applications: Screen Sharing · System Settings · MeetLite
Interfaces: desk · Desktop GUI
GUI need · task setting: G3 · GUI-only
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click drag · Drag & drop nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 3 / 5

Proposed verifier

Remote Mac: default input device UID = virtual USB Headset; input volume 0.65-0.75; TCC.db kTCCServiceMicrophone auth_value 2 for MeetLite bundle; MeetLite test log 'Mic OK' after the changes. TCC grant is user-only via the GUI on an unmanaged Mac.

Proposed partial credit

30% input device; 20% volume; 30% mic permission; 20% app test passes

R01.08.01.02-T18 Configure a SAML app integration in Okta for a sandbox service provider

Original instruction

In the Okta sandbox org, create SAML 2.0 app `Wiki-Sandbox` using the SP metadata in `input/sp_metadata.xml` (ACS URL, entity ID), NameID format EmailAddress, attribute statements `firstName`, `lastName`, `groups` (filter: starts with `wiki-`), assign group `wiki-editors`, and confirm a test user can log into the SP.

Platforms: web · Any OS (web)
Applications: Okta
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: None declared
Proposed difficulty: 4 / 5

Proposed verifier

Okta API app settings.signOn: ssoAcsUrl and audience equal metadata; subjectNameIdFormat email; attributeStatements names and group filter regex/startsWith wiki-; group assigned; SP log shows a successful assertion for the test user with groups containing only wiki-* values.

Proposed partial credit

30% ACS/entity; 30% attributes incl. group filter; 20% assignment; 20% test SSO succeeds

R01.08.01.02-T19 Close a multi-cause helpdesk ticket across AD, a file share and an RDP session

Original instruction

Ticket HD-7781: synthetic user `bnoor` cannot sign in, and once in, cannot open `\\fs01\finance` and Outlook starts with a temporary profile. Causes are seeded across AD (locked, expired password), group membership, and a corrupted local profile on their PC. Fix all of them using ADUC and an RDP session to the PC; summarise actions in `C:\triage\HD-7781.md`.

Platforms: win · Windows
Applications: Active Directory Users and Computers · Remote Desktop · Computer Management
Interfaces: desk · Desktop GUI
GUI need · task setting: G3 · GUI-only
GUI need · ordinary access: G3 · GUI-only
Interaction primitives: click · Point & click type · Text & forms nav · Pan/zoom/scroll
Work product: WP08 · App/system state
Conditions: long · Long-horizon multiapp · Multi-app hidden · Hidden/stale state
Proposed difficulty: 5 / 5

Proposed verifier

Account unlocked, password reset per ticket; member of FIN-Share-RW; on the PC, ProfileList has no .bak duplicate and the user loads a permanent profile with old Documents restored (hash match); share opens as bnoor; report lists the 4 causes. The PC is reachable only via the RDP session (no WinRM/admin shares), and DC script-block logging detects AD cmdlets or net user, voiding the account milestone.

Proposed partial credit

20% account fixed; 20% group; 40% profile repaired with data kept; 20% report

R01.08.01.02-T20 Respond to a risky sign-in for a test user in Entra ID Protection

Original instruction

Entra ID Protection flags sign-ins for synthetic user `tkim@lab.onmicrosoft.com`. Review the sign-in logs, identify the sign-in from an atypical location (record its request ID, country and IP in `answer.json`), confirm the user compromised, revoke sessions, and require a password reset at next sign-in. Do not delete the user.

Platforms: web · Any OS (web)
Applications: Entra admin center
Interfaces: brow · Browser
GUI need · task setting: HY · Hybrid
GUI need · ordinary access: G2 · GUI-essential
Interaction primitives: nav · Pan/zoom/scroll vis · Visual judgment click · Point & click
Work product: WP08 · App/system state
Conditions: risk · Irreversible/risky
Proposed difficulty: 5 / 5

Proposed verifier

answer.json matches the seeded risky sign-in among 30 benign sign-ins; Graph riskyUsers tkim riskState confirmedCompromised; signInSessionsValidFromDateTime after task start; passwordProfile forceChangePasswordNextSignIn true; user still exists.

Proposed partial credit

40% correct sign-in identified; 20% confirmed compromised; 20% sessions revoked; 20% reset required

Mapped research references

No benchmark reference is assigned to this class in the current mapping.

In this workflow family

R01.08.01.01 Device policies & configuration profiles