I've been asked to evaluate ZCM and I just wanted to check a couple of things.

1 Am I right in thinking that using ZCM you can import and apply Group Policy from Active Directory but not edit or change group policy in any way. So there's a one way relationship with AD, you can't in any way read from and also write to it?

2. Given that it's best practice to have ZCM on a server of its own, rather than the DC, what's the best way to get access to AD store from the ZCM server? Just share it across the network?

I know these are pretty basic questions, so please bear with me. I'm just in the process of working my way around the program.