Read Only Domain Controller (RODC)

What is a Read Only Domain Controller (RODC)?

An RODC improves security

An RODC contains a read‑only copy of the AD DS database.  If an RODC is compromised, the potential loss of information is much less than with a full read/write domain controller. By default, an RODC does not cache any user passwords. This improves security.

When should you use a RODC?

There are several reasons to consider an RODC instead of a regular domain controller.

• Security. A site where there isn't a physically secure facility to house the server, and there is few, if any, local IT staff to support and monitor the server.
• Users and Services. You would like users to be provided services and authentication locally, rather than have to contact a domain controller in the data center.
• Network Latency. Users typically connect to multiple services during a workday. So, service ticket activity happens regularly. Authentication and service ticket activity over a WAN link between a branch office and a hub site can result in slow or unreliable performance.

What is the most common scenario for an RODC?

The most common scenario for using an RODC is a branch office.

Data Center	Branch Office
Writable domain controller Specifies the password replication policy	Read-only domain controller Caches passwords, if allowed Contains all domain objects Has a subset of the object attributes Authentication is through the data center Has a local Administrator group

Powershell - RODC Installation and Password Caching

Try It: RODC Installation and Password Caching

A. Datum is adding a new branch office. You have been asked to configure an RODC to service logon requests at the branch office. You also need to configure password policies that ensure caching only of passwords for local users in the branch office.

In this Try It you will verify requirements for installing a RODC, install the RODC, and configure password replication policies.

Note:  In this lab you will pre-create the RODC computer account. By pre-creating this account, you can delegate the second part of the RODC deployment to a non-administrative user. For example, if the remote site (branch office) doesn't have any IT administrators,  a non-IT user at the site can complete the installation. If your intention is to deploy an RODC yourself and you are a domain administrator, you will often bypass the pre-creation and just go straight to the deployment.

Create the RODC account on LON-DC1

1. LON-SVR1 should not be on the domain when the RODC account is created on LON-DC1. So, follow these steps to move it temporarily to a Workgroup.
2. Login to LON-SVR1 as Adatum\Administrator with the password Pa$$w0rd.
3. In Server Manager, select Local Server, and then next to Domain click Adatum.com
4. Click Change and put LON-SVR1 in a workgroup named TEMPORARY.
5. Acknowledge the message that you will need the Administrator’s password to rejoin the domain.
6. As prompted, restart LON-SVR1.
7. Log on to LON-DC1 as Adatum\Administrator with password Pa$$w0rd.
8. In Server Manager, click Tools, and then select Active Directory Users and Computers.
9. Delete the LON-SVR1 computer account from the Computers container.
10. Read and acknowledge the subtree deletion information.
11. Right-click the Domain Controllers OU, and select Pre-create Read-only Domain Controller account.

• Network credentials: My current logged on credentials
• Computer name: LON-SVR1
• Site: Default-first-site-name
• Leave selected DNS server and Global catalog
• Delegate to: ADATUM\IT

1. Finish the Wizard and verify LON-SVR1 has been added to the Domain Controllers OU.

Add the AD DS role to LON-SVR1

1. Login to LON-SVR1 as Adatum\Administrator with the password Pa$$w0rd.
2. In the Server Manager Dashboard, click Add roles and features, and then on the Server Roles page, select the Active Directory Domain Services role.
3. Take all of the default values, and wait for the installation to complete.
4. In Server Manager, click the Notification flag, and select Promote this server to a domain controller.
5. Complete the post deployment steps using the default options except those listed below. Notice you are adding a domain controller to an existing domain. Also, you will use the pre-created RODC account.

• Domain: Adatum.com
• Network credentials: Adatum.com\Administrator
• Password: Pa$$w0rd
• Directory Services restore mode password: Pa$$w0rd
• Read the Warning message: Use existing RODC account
• Replicate from: LON-DC1.Adatum.com
• Take the defaults for the location of the AD DS database.
• Review your selections and click View Script. Notice the PowerShell commands that are being used.

1. When the installation is complete, LON-SVR1 will automatically restart.

Configure password replication

1. On LON-DC1, from Server Manager, open Active Directory Users and Computers.
2. In the Users container, view the membership of the Allowed RODC Password Replication Group, and verify that there are no current members.
3. In the Research OU, create a new global security group name Remote Office Users.
4. On the Members tab, add Aziz, Colin and LON-CL1 to the membership of Remote Office Users.
5. In the Domain Controllers OU, open the properties of LON-SVR1.
6. On the Password Replication Policy tab, allow the Remote Office Users group to replicate passwords to LON-SVR1.
7. Apply your changes.
8. Click Advanced. On the Resultant Policy tab, add Aziz, and then confirm that Aziz’s password can be cached.

Monitor credential caching

1. Attempt to sign in to LON-SVR1 as Aziz. This sign-in will fail because Aziz does not have permission to sign in to the RODC, but authentication is performed and the credentials are now cached.
2. On LON-DC1, in Active Directory Users and Computers, in the Domain Controllers OU, open the properties of LON-SVR1.
3. On the Password Replication Policy tab, open the Advanced configuration.
4. On the Policy Usage tab, select the Accounts that have been authenticated to this Read-only Domain Controller option. Notice that Aziz’s password has been cached.

Populate credential caching

1. On LON-DC1, in Active Directory Users and Computers, in the Domain Controllers OU, right-click LON-SVR1, and then click Properties.
2. On the Password Replication Policy tab, click Advanced.
3. On the Policy Usage tab, prepopulate the password for Colin and LON-CL1.
4. Read the list of cached passwords, and then confirm that Colin and LON-CL1 have been added.
5. Close all open windows on LON-DC1.

Microsoft INF200.1x, Windows Server 2012 Fundamentals: Infrastructure - Physical Component - Domain Controller

What is Active Directory Domain Services (AD DS)?

Active Directory Domain Services (AD DS) is a scalable, secure, and manageable infrastructure for user and resource management. AD DS is a Windows Server role that's installed and hosted on a server known as a domain controller. AD DS uses Lightweight Directory Access Protocol (LDAP) to access, search, and change the directory service. LDAP is a based on the X.500 standard and TCP/IP.

AD DS provides a centralized system for managing users, computers, and other resources on the network. AD DS features a centralized directory, single sign-on access, integrated security, scalability, and a common management interface.

What is a domain controller?

A domain controller hosts the AD DS role

A domain controller is a server that has the AD DS role installed and has been promoted to a domain controller. By default, it's configured to store a copy of the AD DS directory database. All domain controllers, except Read Only Domain Controllers (RODCs), store a read/write copy of the AD DS database.

Replication keeps the domain controllers in sync

Domain controllers use a multi-master replication process; for most operations, data can be changed on any domain controller, except on RODCs. The AD DS replication service then synchronizes the changes that are made to the AD DS database to other domain controllers in the domain.  

You should always have at least two domain controllers

As a best practice, an AD DS domain should have at least two domain controllers. This makes the AD DS database more available, and spreads the authentication load during peak sign-in times.

What is a Read Only Domain Controller (RODC)?

An RODC improves security

An RODC contains a read‑only copy of the AD DS database.  If an RODC is compromised, the potential loss of information is much less than with a full read/write domain controller. By default, an RODC does not cache any user passwords. This improves security.

When should you use a RODC?

There are several reasons to consider an RODC instead of a regular domain controller.

• Security. A site where there isn't a physically secure facility to house the server, and there is few, if any, local IT staff to support and monitor the server.
• Users and Services. You would like users to be provided services and authentication locally, rather than have to contact a domain controller in the data center.
• Network Latency. Users typically connect to multiple services during a workday. So, service ticket activity happens regularly. Authentication and service ticket activity over a WAN link between a branch office and a hub site can result in slow or unreliable performance.

What is the most common scenario for an RODC?

The most common scenario for using an RODC is a branch office.

Data Center	Branch Office
Writable domain controller Specifies the password replication policy	Read-only domain controller Caches passwords, if allowed Contains all domain objects Has a subset of the object attributes Authentication is through the data center Has a local Administrator group