Windows NT domain administration scenario: you created a new domain local group “R-Editors” in the RESEARCH domain. The LAB domain trusts the RESEARCH domain. From where can you assign access permissions to resources using the R-Editors group with least friction?

Introduction / Context:
Windows NT distinguished global, local, and domain local groups, each with particular scopes. Domain local groups (created in a domain) are intended to be used to assign permissions on resources in that same domain’s computers. Correctly choosing where to perform the ACL assignment helps avoid scope and trust confusion.

Given Data / Assumptions:

• R-Editors is a domain local group in the RESEARCH domain.
• LAB trusts RESEARCH (LAB users can be granted access to RESEARCH resources if desired).
• We want to assign permissions to resources using R-Editors.

Concept / Approach:
Domain local groups can be used to assign permissions only within their own domain. Therefore, you typically perform ACL changes on a machine that is a member of the RESEARCH domain (for example, a Windows NT Workstation or Server in RESEARCH). Trust direction (LAB trusts RESEARCH) does not move the scope of the domain local group; it only affects which accounts can be added or authenticated for access.

Step-by-Step Solution:

Verification / Alternative check:
NT domain best practices: “Global groups for users, Domain Local groups for permissions, and place Global into Local” (AGDLP) pattern confirms the usage within the same domain.

Why Other Options Are Wrong:

Common Pitfalls:
Confusing group scope (global vs local) and trust direction; assuming trusts let you use domain local groups across domains for permissions—they do not.

Final Answer:
Any Windows NT Workstation in the RESEARCH domain.