Windows Server 2008 and RODC Read Only Domain Controller

13.7.2009    |    komentáře   komentářů: 0

Windows Server 2008 and RODC Read Only Domain Controller or a read-only domain controller.

What is an RODC (Read Only Domain Controller)?

An RODC is primarily intended for branch offices unable to provide adequate physical security for their servers. Its main characteristic is a read-only copy of the DC database without password hashes. User authentication requests are forwarded to a DC that stores password hashes. By default, an RODC does not cache any user credentials. One disadvantage is that if the network connection (VPN, LAN) between the RODC and a DC with a fully writable database fails, users cannot be authenticated or log on. This can be partly addressed by allowing password hashes to be cached on the RODC using Password Replication Policies, where users or groups are specified. The cache is retained only until the server restarts, after which the user must authenticate again before the hash can be cached on the RODC.

RODC replication

Although an RODC has a copy of the AD database, it is read-only, so replication is always one-way, from a DC with a writable AD database to the RODC. If a user needs to publish changes to AD, the RODC cannot make them and forwards them to a DC with a writable AD database.

Delegating local administrator rights on an RODC

When installing an RODC, you can select a user (Domain Users) and delegate local administrator rights on the new RODC. The user retains their original permissions (Domain Users) in relation to other DCs and can perform administrative tasks (installation, updates, etc.) only on that particular RODC.

Installing an RODC

Use the following procedure to install an RODC:

  1. A domain administrator pre-creates the RODC computer account and specifies the user to receive local administrator rights on this RODC only
  2. pre-creating the account:
    • the Active Directory Users and Computers
    • right-click Domain Controllers organization unit
    • then select Pre-create Read-only Domain Controller account
  3. On the RODC server, start AD installation using dcpromo /UseExistingAccount:Attach or prepare a Windows Server 2008 installation image and deliver it to the branch office with an answer file for RODC installation.

 An RODC can replicate only with Windows Server 2008. The forest and domain functional levels may remain at 2003, but you must run adprep /rodcprep

Link to Microsoft.com

Komentáře