It’s back to the future – remember the Windows NT Backup Domain Controller (BDC)? It could log you on, but you couldn’t make any changes to it. The 2008 version of the BDC goes by the new name of Read-Only Domain Controller. It is intended for deployment in branch offices that have low physical security and/or limited local IT management.
The RODC receives all Active Directory database changes from a writeable domain controller. It has the ability to cache requested credentials (but not for administrators), however it does not contain a full copy of the AD database. The idea is that if an RODC gets stolen, it’s a lot easier to reset the passwords that might have been cached on the RODC – that is, users at the branch office – than it would be to reset the passwords of every user in the forest!
You’ll set up an RODC with new options when you run DCPROMO to promote a member server to a domain controller. The setup wizard also gives you the opportunity to pre-designate a group that can manage the RODC. The benefit of doing this is that you don’t have to have a Domain Admin at the branch office; the delegated RODC admin can log on to the RODC but doesn’t have the broad directory access that a Domain Admin has.
Most of you reading this blog know that Active Directory and DNS go together like the peanut butter and chocolate in a Reese’s peanut-butter cup. So it comes as no surprise that you can set up DNS on an RODC. If you do this, Microsoft recommends that branch office clients should point to the RODC’s DNS as the preferred DNS server, with an alternate at the hub site running writeable DNS.
See recent blog posts…
Server Core – Only install the services you need
The Laundry List of Key Server 2008 Features
Windows Server 2008 Migration Considerations
