Microsoft RODC Read Only Domain Controller


Read Only Domain Controllers

A new feature in Windows 2008 is a new type of domain controller the Read-Only Domain Controller known as RODCs. An RODC makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat. The RODC also have copy of the Active Directory (AD) database, but the contents of the replica of the database on the domain controller is read-only and write operations are not supported. It is also important to know that the RODCs do not participate in Active Directory replication in the same way as writable domain controllers.
The difference between RODC replication and the multimaster replication model between writable domain controllers is that RODC replication is unidirectional. This means all changes from a writable domain controller are propagated to the RODCs. The result of this is that the RODC receives changes, but does not partake in or perform outbound replication with other domain controllers. This provides an extra layer of security as any unauthorized data changes, will not replicate out to other domain controllers. Another new RODC functionality that improves security is the replication that happens between a writable domain controller and a RODC. Here, user account information is replicated, but account passwords are not.

Administrator Role Separation

You can delegate local administrative permissions for an RODC to any domain user without granting that user any user rights for the domain or other domain controllers. This permits a local branch user to log on to an RODC and perform maintenance work on the server. However, the branch user cannot log on to any other domain controller or perform any other administrative task in the domain, and therefore compromising the security of the rest of the domain.

Read-Only AD DS Database

Except for account passwords, an RODC holds most of the Active Directory objects and attributes that a writable domain controller holds. However, changes cannot be made to the database that is stored on the RODC. Changes must be made on a writable domain controller and then replicated back to the RODC.

Read-Only DNS

You can install the DNS Server service on an RODC. An RODC is able to replicate all application directory partitions that DNS uses. If the DNS server is installed on an RODC, clients can query it for name resolution as they query any other DNS server. However, the DNS server on an RODC does not support client updates directly. Consequently, the RODC does not register name server NS resource records for any Active Directory integrated zone that it hosts.

Credential Caching

Credential caching is the storage of user or computer credentials, including the user password. You can configure credential caching on the RODC by modifying the Password Replication Policy for the specific domain controller. If you want the RODC to cache the credentials for all users in the branch office that routinely log on in the office location, you can add all user accounts in the branch office to the Password Replication Policy. Now users will be able to log on to the domain controller even if the wide area network WAN connection to a writable domain controller is down. You can also add all of the branch office computer accounts, so that these accounts can authenticate to the RODC even when the WAN link is down. In both cases, the WAN connection to writable domain controller must be available during the first logon for the credentials to be cached.

Prerequisite When Deploying an RODC

The following things should be done and complete before installing RODCs:

Active Directory running on Windows Server 2003 or Windows Server 2008 must already exist in the environment.

The Active Directory schema must support the Windows 2008 Server extensions.

The forest and domain functional level must be running Windows Server 2003 or higher.

At least one domain controller within the domain must be running Windows 2008.

The PDC Emulator FSMO role must be running Windows 2008.

A regular non-read-only (writable) domain controller must already exist within the Active Directory infrastructure.

The RODC cannot be the first domain controller within the Active Directory infrastructure.

If the DNS service will be configured on a Server Core installation, a non-read-only DNS server must be present within the domain.

Comments

Post a Comment

Popular posts from this blog

How to check when Sharepoint List was created using PowerShell.

Image
While the SharePoint admin console may not offer a straightforward way to view the creation date of a SharePoint list, PowerShell comes to the rescue. In this blog post, we'll explore how you can effortlessly retrieve this information using SharePoint PowerShell. Let's dive into the steps and make list creation dates a breeze to access in your SharePoint environment. Install SharePoint module in your PS using following PS-CMD. Install-Module -Name Microsoft.Online.SharePoint.PowerShell If you want to check version of SharePoint install module using following CMD Get-Module -Name Microsoft.Online.SharePoint.PowerShell -ListAvailable | Select Name,Version Now connect SharePoint Admin center using following CMD in PowerShell. Connect-SPOService -Url https://YourAdminWebAddress.sharepoint.com If you don’t know address go to https://admin.microsoft.com/ Admin Centers and open SharePoint admin center and copy URL.   Now connect your SharePoint site using following ...
Read more

How to connect SharePoint online with SharePoint designer 2013

How to connect SharePoint online with SharePoint designer 2013 Note: If you encounter the permission error, the following steps will help you resolve it as well. Download SharePoint designer 2013 Allow custom scripting feature from SharePoint Management Shell.       Connect SharePoint Online site with SharePoint designer 2013.   Allow custom scripting feature from SharePoint Management Shell 1.        Download and Install SharePoint Online Management Shell 2.       Connect your SharePoint Admin portal to SharePoint Management shell by using following PS-CMD. if you don't have SharePoint Management Shell first please download and Install it.      Connect-SPOService -Url https://admin-domain.sharepoint.com -Credential Admin@youradminidEmailID.com      Run following CMD after connecting to allow custom scripting to connect SharePoint Designer 2013      set-SPOsite h...
Read more

Unable to add SMTP address in Office365 (Detailed error message: Unable to update the specified properties for on-premises mastered Directory Sync objects or objects currently undergoing migration. )

Image
 Scenario: You have migrated from In-House Exchange server to Microsoft365 You Decommissioned you Exchange server You have disbaled/deleted users mailbox and want to add old users SMTP in Microsoft365 mailbox Exchange online error: While trying to add SMTP from Exchange online to Microsoft365 getting error “  Email address type update failed Error: Error executing request. An Azure Active Directory call was made to keep object in sync between Azure Active Directory and Exchange Online. However, it failed. Detailed error message: Unable to update the specified properties for on-premises mastered Directory Sync objects or objects currently undergoing migration. DualWrite (Graph) RequestId: The issue may be transient and please retry a couple of minutes later. If issue persists, please see exception members for more information. ” | You cannot directly add additional SMTP for Migrated users from Exchange Online because If you are syncing from your AD to Azure (using AAD...
Read more