Read Only Domain Controller (RODC)

What is a Read Only Domain Controller (RODC)?

An RODC improves security

An RODC contains a read‑only copy of the AD DS database.  If an RODC is compromised, the potential loss of information is much less than with a full read/write domain controller. By default, an RODC does not cache any user passwords. This improves security.

When should you use a RODC?

There are several reasons to consider an RODC instead of a regular domain controller.

• Security. A site where there isn't a physically secure facility to house the server, and there is few, if any, local IT staff to support and monitor the server.
• Users and Services. You would like users to be provided services and authentication locally, rather than have to contact a domain controller in the data center.
• Network Latency. Users typically connect to multiple services during a workday. So, service ticket activity happens regularly. Authentication and service ticket activity over a WAN link between a branch office and a hub site can result in slow or unreliable performance.

What is the most common scenario for an RODC?

The most common scenario for using an RODC is a branch office.

Data Center	Branch Office
Writable domain controller Specifies the password replication policy	Read-only domain controller Caches passwords, if allowed Contains all domain objects Has a subset of the object attributes Authentication is through the data center Has a local Administrator group