Chapter 8. Read-Only Domain Controllers

This chapter covers the following subjects: Installing a Read-Only Domain Controller: This section introduces you to the advantages of using a read-only domain controller (RODC) in a branch office and then shows you how to install this computer and to prestage its computer account at a writable domain controller. Managing a Read-Only Domain Controller: This section shows you how to define administrator roles at an RODC and discusses how passwords are stored and replicated on the RODC. Several security measures that help you to protect the RODC are also outlined.

As previously mentioned in Chapter 1, “Getting Started with Active Directory,” a read-only domain controller is a domain controller that contains a read-only copy of the AD DS database. It is most useful in situations such as a branch office where physical security of the domain controller might be of concern. The RODC can perform all client-based actions such as authenticating users and distributing group policies to clients, but administrators cannot make changes to the database directly from the RODC.